theory VSpace_C

lemma performASIDPoolInvocation_ccorres:
  notes option.case_cong_weak [cong]
  shows
  "ccorres (K (K \<bottom>) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_')
       (invs' and cte_wp_at' (isPDCap o cteCap) ctSlot and asid_pool_at' poolPtr
        and K (asid \<le> mask asid_bits))
       (UNIV \<inter> \<lbrace>\<acute>poolPtr = Ptr poolPtr\<rbrace> \<inter> \<lbrace>\<acute>asid = asid\<rbrace> \<inter> \<lbrace>\<acute>pdCapSlot = Ptr ctSlot\<rbrace>)
       []
       (liftE (performASIDPoolInvocation (Assign asid poolPtr ctSlot)))
       (Call performASIDPoolInvocation_'proc)" apply (simp only: liftE_liftM ccorres_liftM_simp) apply (cinit lift: poolPtr_' asid_' pdCapSlot_') apply (rule ccorres_symb_exec_l) apply (rule ccorres_symb_exec_l) apply (rule_tac P="ko_at' (ASIDPool pool) poolPtr" in ccorres_cross_over_guard) apply (rule ccorres_rhs_assoc2) apply (rule_tac ccorres_split_nothrow [where r'=dc and xf'=xfdc]) apply (simp add: updateCap_def) apply (rule_tac A="cte_wp_at' ((=) oldcap o cteCap) ctSlot
                                and K (isPDCap oldcap \<and> asid \<le> mask asid_bits)"
                         and A'=UNIV in ccorres_guard_imp2) apply (rule ccorres_pre_getCTE) apply (rule_tac P="cte_wp_at' ((=) oldcap o cteCap) ctSlot
                                 and K (isPDCap oldcap \<and> asid \<le> mask asid_bits)
                                 and cte_wp_at' ((=) rv) ctSlot"
                          and P'=UNIV in ccorres_from_vcg) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: cte_wp_at_ctes_of) apply (erule (1) rf_sr_ctes_of_cliftE) apply (clarsimp simp: typ_heap_simps) apply (rule conjI) apply (clarsimp simp: isPDCap_def) apply (drule cap_CL_lift) apply (drule (1) cap_to_H_PDCap_tag) apply simp apply (clarsimp simp: typ_heap_simps' isPDCap_def) apply (rule fst_setCTE [OF ctes_of_cte_at], assumption) apply (erule bexI [rotated]) apply clarsimp apply (frule (1) rf_sr_ctes_of_clift) apply clarsimp apply (clarsimp simp: rf_sr_def cstate_relation_def typ_heap_simps
                              Let_def cpspace_relation_def) apply (rule conjI) apply (erule (2) cmap_relation_updI) apply (clarsimp simp: ccte_relation_def) apply (clarsimp simp: cte_lift_def) apply (simp split: option.splits) apply clarsimp apply (case_tac cte') apply clarsimp apply (rule conjI) apply (clarsimp simp: cap_lift_def Let_def cap_tag_defs) apply clarsimp apply (simp add: cte_to_H_def c_valid_cte_def) apply (simp add: cap_page_directory_cap_lift) apply (simp (no_asm) add: cap_to_H_def) apply (simp add: asid_bits_def le_mask_imp_and_mask word_bits_def) apply (erule (1) cap_lift_PDCap_Base) apply simp apply (erule_tac t = s' in ssubst) apply (simp add: heap_to_user_data_def) apply (rule conjI) apply (erule (1) setCTE_tcb_case) apply (simp add: carch_state_relation_def cmachine_state_relation_def
                               typ_heap_simps h_t_valid_clift_Some_iff
                               cvariable_array_map_const_add_map_option[where f="tcb_no_ctes_proj"]) apply (clarsimp simp: cte_wp_at_ctes_of) apply ceqv apply (rule ccorres_move_c_guard_cte) apply (rule ccorres_symb_exec_r) apply (rule ccorres_Guard_Seq[where F=ArrayBounds])? apply (rule ccorres_move_c_guard_ap) apply (simp only: Kernel_C.asidLowBits_def word_sle_def) apply (rule ccorres_Guard_Seq)+ apply (rule ccorres_add_return2) apply (rule ccorres_split_nothrow_novcg) apply (rule setObjectASID_Basic_ccorres) apply ceqv apply (rule ccorres_from_vcg_throws [where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def) apply wp apply (simp add: guard_is_UNIV_def) apply (vcg) apply (rule conseqPre, vcg) apply clarsimp apply wp apply vcg apply (wp getASID_wp) apply simp apply wp apply (simp add: inv_def) apply (wp getASID_wp) apply simp apply (rule empty_fail_getObject) apply simp apply wp apply (wp getSlotCap_wp') apply simp apply (clarsimp simp: cte_wp_at_ctes_of) apply (rule conjI) apply (clarsimp dest!: asid_pool_at'_ko simp: obj_at'_def) apply (rule cmap_relationE1[OF cmap_relation_cte], assumption+) apply (clarsimp simp: typ_heap_simps cap_get_tag_isCap_ArchObject2
                        isPDCap_def isCap_simps
                        order_le_less_trans[OF word_and_le1] asid_low_bits_def
                 dest!: ccte_relation_ccap_relation) apply (simp add: casid_pool_relation_def mask_def) apply (rule array_relation_update) apply (drule (1) asid_pool_at_rf_sr) apply (clarsimp simp: typ_heap_simps) apply (case_tac pool') apply (simp add: casid_pool_relation_def) apply simp apply (simp add: option_to_ptr_def option_to_0_def) apply (erule(1) rf_sr_ctes_of_cliftE, simp(no_asm_simp)) apply (clarsimp simp: ccap_relation_def map_option_Some_eq2 cap_lift_PDCap_Base) apply (simp add: asid_low_bits_def) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (K (K (\<lambda>_. False)) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and cte_wp_at' (isPDCap \<circ> cteCap) ctSlot and asid_pool_at' poolPtr and K (asid \<le> mask local.asid_bits)) (UNIV \<inter> \<lbrace>\<acute>poolPtr = ap_Ptr poolPtr\<rbrace> \<inter> \<lbrace>\<acute>asid = asid\<rbrace> \<inter> \<lbrace>\<acute>pdCapSlot = cte_Ptr ctSlot\<rbrace>) [] (liftE (performASIDPoolInvocation (asidpool_invocation.Assign asid poolPtr ctSlot))) (Call performASIDPoolInvocation_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and cte_wp_at' (isPDCap \<circ> cteCap) ctSlot and asid_pool_at' poolPtr and K (asid \<le> mask local.asid_bits)) (UNIV \<inter> \<lbrace>\<acute>poolPtr = ap_Ptr poolPtr\<rbrace> \<inter> \<lbrace>\<acute>asid = asid\<rbrace> \<inter> \<lbrace>\<acute>pdCapSlot = cte_Ptr ctSlot\<rbrace>) [] (performASIDPoolInvocation (asidpool_invocation.Assign asid poolPtr ctSlot)) (Call performASIDPoolInvocation_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q491 pdCapSlot asida poolPtra) (?Q'491 pdCapSlot asida poolPtra) [SKIP] (do oldcap <- getSlotCap ctSlot;
pool <- liftM (inv asidpool.ASIDPool) (getObject poolPtr);
y <- updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap)));
setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>pdCapSlot asida poolPtra s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (isPDCap \<circ> cteCap) ctSlot and asid_pool_at' poolPtr and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q491 pdCapSlot asida poolPtra s \<and> s' \<in> ?Q'491 pdCapSlot asida poolPtra proof (prove)
goal (5 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q497 pdCapSlot asida poolPtra oldcap) (?Q'497 pdCapSlot asida poolPtra oldcap) [SKIP] (do pool <- liftM (inv asidpool.ASIDPool) (getObject poolPtr);
y <- updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap)));
setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 pdCapSlot asida poolPtra\<rbrace> getSlotCap ctSlot \<lbrace>?Q497 pdCapSlot asida poolPtra\<rbrace>
 4. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap ctSlot)
 5. \<And>pdCapSlot asida poolPtra s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (isPDCap \<circ> cteCap) ctSlot and asid_pool_at' poolPtr and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q491 pdCapSlot asida poolPtra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ?Q497 pdCapSlot asida poolPtra rv s \<longrightarrow> s' \<in> ?Q'497 pdCapSlot asida poolPtra rv} proof (prove)
goal (8 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q502 pdCapSlot asida poolPtra oldcap pool) (?Q'502 pdCapSlot asida poolPtra oldcap pool) [SKIP] (do y <- updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap)));
setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>?Q502 pdCapSlot asida poolPtra oldcap\<rbrace>
 4. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 5. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 pdCapSlot asida poolPtra\<rbrace> getSlotCap ctSlot \<lbrace>?Q497 pdCapSlot asida poolPtra\<rbrace>
 7. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap ctSlot)
 8. \<And>pdCapSlot asida poolPtra s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (isPDCap \<circ> cteCap) ctSlot and asid_pool_at' poolPtr and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q491 pdCapSlot asida poolPtra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ?Q497 pdCapSlot asida poolPtra rv s \<longrightarrow> s' \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ?Q502 pdCapSlot asida poolPtra rv rva s \<longrightarrow> s' \<in> ?Q'502 pdCapSlot asida poolPtra rv rva}} proof (prove)
goal (8 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?P'507 pdCapSlot asida poolPtra oldcap pool) (?Q507 pdCapSlot asida poolPtra oldcap pool) [SKIP] (do y <- updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap)));
setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and ?P'507 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 4. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 5. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 pdCapSlot asida poolPtra\<rbrace> getSlotCap ctSlot \<lbrace>?Q497 pdCapSlot asida poolPtra\<rbrace>
 7. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap ctSlot)
 8. \<And>pdCapSlot asida poolPtra s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (isPDCap \<circ> cteCap) ctSlot and asid_pool_at' poolPtr and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q491 pdCapSlot asida poolPtra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ?Q497 pdCapSlot asida poolPtra rv s \<longrightarrow> s' \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (ko_at' (asidpool.ASIDPool rva) poolPtr and ?P'507 pdCapSlot asida poolPtra rv rva) s \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ko_at' (asidpool.ASIDPool rva) poolPtr s \<longrightarrow> s' \<in> ?Q507 pdCapSlot asida poolPtra rv rva}}} proof (prove)
goal (8 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?P'507 pdCapSlot asida poolPtra oldcap pool) (?Q507 pdCapSlot asida poolPtra oldcap pool) [SKIP] (do y <- updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap)));
setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and ?P'507 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 4. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 5. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 pdCapSlot asida poolPtra\<rbrace> getSlotCap ctSlot \<lbrace>?Q497 pdCapSlot asida poolPtra\<rbrace>
 7. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap ctSlot)
 8. \<And>pdCapSlot asida poolPtra s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (isPDCap \<circ> cteCap) ctSlot and asid_pool_at' poolPtr and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q491 pdCapSlot asida poolPtra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ?Q497 pdCapSlot asida poolPtra rv s \<longrightarrow> s' \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (ko_at' (asidpool.ASIDPool rva) poolPtr and ?P'507 pdCapSlot asida poolPtra rv rva) s \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ko_at' (asidpool.ASIDPool rva) poolPtr s \<longrightarrow> s' \<in> ?Q507 pdCapSlot asida poolPtra rv rva}}} proof (prove)
goal (12 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P510 pdCapSlot asida poolPtra oldcap pool) (?P'510 pdCapSlot asida poolPtra oldcap pool) [SKIP] (updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap)))) (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)))
 2. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 3. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 4. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 5. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 6. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (?P510 pdCapSlot asida poolPtra oldcap pool and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 9. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 pdCapSlot asida poolPtra\<rbrace> getSlotCap ctSlot \<lbrace>?Q497 pdCapSlot asida poolPtra\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P510 (cte_Ptr ctSlot) asid (ap_Ptr poolPtr) oldcap pool) (?P'510 (cte_Ptr ctSlot) asid (ap_Ptr poolPtr) oldcap pool) [SKIP] (do cte <- getCTE ctSlot;
setCTE ctSlot (cteCap_update (\<lambda>_. capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) cte)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),asid));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),1)))
 2. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 3. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 4. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 5. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 6. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (?P510 pdCapSlot asida poolPtra oldcap pool and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 9. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 pdCapSlot asida poolPtra\<rbrace> getSlotCap ctSlot \<lbrace>?Q497 pdCapSlot asida poolPtra\<rbrace>
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q517 pdCapSlot asida poolPtra oldcap pool) (?Q'517 pdCapSlot asida poolPtra oldcap pool) [SKIP] (do cte <- getCTE ctSlot;
setCTE ctSlot (cteCap_update (\<lambda>_. capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) cte)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),asid));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),1)))
 2. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q517 pdCapSlot asida poolPtra oldcap pool s \<and> s' \<in> ?Q'517 pdCapSlot asida poolPtra oldcap pool
 3. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 4. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 5. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 6. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 7. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 9. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 10. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap pool rv. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P519 pdCapSlot asida poolPtra oldcap pool rv) (?P'519 pdCapSlot asida poolPtra oldcap pool rv) [SKIP] (setCTE ctSlot (cteCap_update (\<lambda>_. capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) rv)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),asid));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),1)))
 2. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> ?P519 pdCapSlot asida poolPtra oldcap pool cte s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> ?P'519 pdCapSlot asida poolPtra oldcap pool (cte_to_H cte')}
 3. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 4. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 5. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 6. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 7. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 9. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 10. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap pool rv. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) rv) ctSlot) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),asid));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),1)) {s. \<exists>(rv, \<sigma>')\<in>fst (setCTE ctSlot (cteCap_update (\<lambda>_. capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) rv) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)}
 2. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 3. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 4. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 5. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 6. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 7. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 9. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 10. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap pool rv \<sigma>. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> {s. (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) rv) ctSlot) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot \<and> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr ctSlot \<and> t \<Turnstile>\<^sub>c cparent (cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift t (cparent (cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>ta. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift t (cparent (cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capPDIsMapped_CL := 1 && mask 1\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (cparent (cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift t (cparent (cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals t))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (setCTE ctSlot (cteCap_update (\<lambda>_. capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) rv) \<sigma>). (\<sigma>', s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>)))))}
 2. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 3. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 4. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 5. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 6. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 7. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 9. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 10. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>\<sigma> x cte. \<lbrakk>isPDCap (cteCap cte); asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some cte; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_Ptr ctSlot \<and> cap_get_tag (cte_C.cap_C (the (cslift x (cte_Ptr ctSlot)))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift x (cte_Ptr ctSlot))))\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift x (cte_Ptr ctSlot))))) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr ctSlot \<and> cap_get_tag (cte_C.cap_C (the (cslift t (cte_Ptr ctSlot)))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>ta. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift t (cte_Ptr ctSlot))))\<lparr>capPDIsMapped_CL := 1\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift t (cte_Ptr ctSlot))))) (t_hrs_' (globals t))) \<longrightarrow> (\<exists>xa\<in>fst (setCTE ctSlot (cteCap_update (\<lambda>_. capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap (cteCap cte)))) cte) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)))
 2. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 3. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 4. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 5. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 6. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 7. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 9. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 10. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>\<sigma> x cte cte' ctel'. \<lbrakk>isPDCap (cteCap cte); asid \<le> mask local.asid_bits; (\<sigma>, x) \<in> rf_sr; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cte = cte_to_H ctel'; cl_valid_cte ctel'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_Ptr ctSlot \<and> cap_get_tag (cte_C.cap_C (the (cslift x (cte_Ptr ctSlot)))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift x (cte_Ptr ctSlot))))\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift x (cte_Ptr ctSlot))))) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr ctSlot \<and> cap_get_tag (cte_C.cap_C (the (cslift t (cte_Ptr ctSlot)))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>ta. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift t (cte_Ptr ctSlot))))\<lparr>capPDIsMapped_CL := 1\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift t (cte_Ptr ctSlot))))) (t_hrs_' (globals t))) \<longrightarrow> (\<exists>xa\<in>fst (setCTE ctSlot (cteCap_update (\<lambda>_. capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap (cteCap cte)))) cte) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)))
 2. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 3. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 4. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 5. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 6. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 7. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 9. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 10. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>\<sigma> x cte' ctel'. \<lbrakk>isPDCap (cap_to_H (cap_CL ctel')); asid \<le> mask local.asid_bits; (\<sigma>, x) \<in> rf_sr; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'\<rbrakk> \<Longrightarrow> cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr ctSlot \<and> cap_get_tag (cte_C.cap_C (the (cslift t (cte_Ptr ctSlot)))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>ta. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift t (cte_Ptr ctSlot))))\<lparr>capPDIsMapped_CL := 1\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift t (cte_Ptr ctSlot))))) (t_hrs_' (globals t))) \<longrightarrow> (\<exists>xa\<in>fst (setCTE ctSlot (cteCap_update (\<lambda>_. capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap (cap_to_H (cap_CL ctel'))))) (cte_to_H ctel')) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)))
 2. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 3. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 4. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 5. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 6. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 7. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 9. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 10. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>\<sigma> x cte' ctel'. \<lbrakk>isPDCap (cap_to_H (cap_CL ctel')); asid \<le> mask local.asid_bits; (\<sigma>, x) \<in> rf_sr; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'\<rbrakk> \<Longrightarrow> cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap
 2. \<And>\<sigma> x cte' ctel'. \<lbrakk>isPDCap (cap_to_H (cap_CL ctel')); asid \<le> mask local.asid_bits; (\<sigma>, x) \<in> rf_sr; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'\<rbrakk> \<Longrightarrow> \<forall>t. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr ctSlot \<and> cap_get_tag (cte_C.cap_C (the (cslift t (cte_Ptr ctSlot)))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>ta. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift t (cte_Ptr ctSlot))))\<lparr>capPDIsMapped_CL := 1\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift t (cte_Ptr ctSlot))))) (t_hrs_' (globals t))) \<longrightarrow> (\<exists>xa\<in>fst (setCTE ctSlot (cteCap_update (\<lambda>_. capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap (cap_to_H (cap_CL ctel'))))) (cte_to_H ctel')) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))
 3. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 4. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 5. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 6. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 7. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 8. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 10. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>\<sigma> x cte' ctel' p asida. \<lbrakk>asid \<le> mask local.asid_bits; (\<sigma>, x) \<in> rf_sr; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida)\<rbrakk> \<Longrightarrow> cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap
 2. \<And>\<sigma> x cte' ctel'. \<lbrakk>isPDCap (cap_to_H (cap_CL ctel')); asid \<le> mask local.asid_bits; (\<sigma>, x) \<in> rf_sr; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'\<rbrakk> \<Longrightarrow> \<forall>t. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr ctSlot \<and> cap_get_tag (cte_C.cap_C (the (cslift t (cte_Ptr ctSlot)))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>ta. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift t (cte_Ptr ctSlot))))\<lparr>capPDIsMapped_CL := 1\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift t (cte_Ptr ctSlot))))) (t_hrs_' (globals t))) \<longrightarrow> (\<exists>xa\<in>fst (setCTE ctSlot (cteCap_update (\<lambda>_. capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap (cap_to_H (cap_CL ctel'))))) (cte_to_H ctel')) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))
 3. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 4. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 5. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 6. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 7. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 8. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 10. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>\<sigma> x cte' ctel' p asida. \<lbrakk>asid \<le> mask local.asid_bits; (\<sigma>, x) \<in> rf_sr; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_lift (cte_C.cap_C cte') = Some (cap_CL ctel')\<rbrakk> \<Longrightarrow> cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap
 2. \<And>\<sigma> x cte' ctel'. \<lbrakk>isPDCap (cap_to_H (cap_CL ctel')); asid \<le> mask local.asid_bits; (\<sigma>, x) \<in> rf_sr; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'\<rbrakk> \<Longrightarrow> \<forall>t. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr ctSlot \<and> cap_get_tag (cte_C.cap_C (the (cslift t (cte_Ptr ctSlot)))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>ta. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift t (cte_Ptr ctSlot))))\<lparr>capPDIsMapped_CL := 1\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift t (cte_Ptr ctSlot))))) (t_hrs_' (globals t))) \<longrightarrow> (\<exists>xa\<in>fst (setCTE ctSlot (cteCap_update (\<lambda>_. capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap (cap_to_H (cap_CL ctel'))))) (cte_to_H ctel')) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))
 3. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 4. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 5. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 6. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 7. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 8. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 10. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>\<sigma> x cte' ctel' p asida. \<lbrakk>asid \<le> mask local.asid_bits; (\<sigma>, x) \<in> rf_sr; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cl_valid_cte ctel'; cap_lift (cte_C.cap_C cte') = Some (cap_CL ctel'); cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap\<rbrakk> \<Longrightarrow> cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap
 2. \<And>\<sigma> x cte' ctel'. \<lbrakk>isPDCap (cap_to_H (cap_CL ctel')); asid \<le> mask local.asid_bits; (\<sigma>, x) \<in> rf_sr; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'\<rbrakk> \<Longrightarrow> \<forall>t. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr ctSlot \<and> cap_get_tag (cte_C.cap_C (the (cslift t (cte_Ptr ctSlot)))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>ta. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift t (cte_Ptr ctSlot))))\<lparr>capPDIsMapped_CL := 1\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift t (cte_Ptr ctSlot))))) (t_hrs_' (globals t))) \<longrightarrow> (\<exists>xa\<in>fst (setCTE ctSlot (cteCap_update (\<lambda>_. capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap (cap_to_H (cap_CL ctel'))))) (cte_to_H ctel')) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))
 3. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 4. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 5. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 6. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 7. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 8. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 10. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>\<sigma> x cte' ctel'. \<lbrakk>isPDCap (cap_to_H (cap_CL ctel')); asid \<le> mask local.asid_bits; (\<sigma>, x) \<in> rf_sr; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'\<rbrakk> \<Longrightarrow> \<forall>t. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr ctSlot \<and> cap_get_tag (cte_C.cap_C (the (cslift t (cte_Ptr ctSlot)))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>ta. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift t (cte_Ptr ctSlot))))\<lparr>capPDIsMapped_CL := 1\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift t (cte_Ptr ctSlot))))) (t_hrs_' (globals t))) \<longrightarrow> (\<exists>xa\<in>fst (setCTE ctSlot (cteCap_update (\<lambda>_. capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap (cap_to_H (cap_CL ctel'))))) (cte_to_H ctel')) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))
 2. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 3. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 4. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 5. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 6. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 7. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 9. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 10. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>\<sigma> x cte' ctel' p asida t cap ta capa. \<lbrakk>asid \<le> mask local.asid_bits; (\<sigma>, x) \<in> rf_sr; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE ctSlot (cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 3. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 4. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 5. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 6. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 7. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 9. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 10. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; (\<sigma>, x) \<in> rf_sr; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); ((), s') \<in> fst (setCTE ctSlot (?cte625 \<sigma> x cte' ctel' p asida t cap ta capa) \<sigma>); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> ?cte625 \<sigma> x cte' ctel' p asida t cap ta capa); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE ctSlot (cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 3. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 4. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 5. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 6. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 7. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 9. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 10. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; (\<sigma>, x) \<in> rf_sr; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'\<rbrakk> \<Longrightarrow> case ((), s') of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 3. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 4. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 5. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 6. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 7. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 9. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 10. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; (\<sigma>, x) \<in> rf_sr; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'\<rbrakk> \<Longrightarrow> (s', x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 3. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 4. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 5. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 6. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 7. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 9. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 10. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; (\<sigma>, x) \<in> rf_sr; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; \<exists>cte'. cslift x (cte_Ptr ctSlot) = Some cte' \<and> cte_lift cte' \<noteq> None \<and> cte_to_H ctel' = cte_to_H (the (cte_lift cte')) \<and> c_valid_cte cte'\<rbrakk> \<Longrightarrow> (s', x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 3. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 4. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 5. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 6. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 7. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 9. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 10. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; (\<sigma>, x) \<in> rf_sr; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'\<rbrakk> \<Longrightarrow> (s', x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 3. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 4. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 5. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 6. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 7. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 9. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 10. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation ((ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel'))) ((cslift x)(cte_Ptr ctSlot \<mapsto> cte_C.cap_C_update (\<lambda>_. capa) cte')) cte_Ptr ccte_relation \<and> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 2. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 3. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 4. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 5. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 6. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 7. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 9. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 10. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation ((ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel'))) ((cslift x)(cte_Ptr ctSlot \<mapsto> cte_C.cap_C_update (\<lambda>_. capa) cte')) cte_Ptr ccte_relation
 2. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 3. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 4. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 5. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 6. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 7. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 8. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 10. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> ccte_relation (cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')) (cte_C.cap_C_update (\<lambda>_. capa) cte')
 2. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> inj cte_Ptr
 3. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 4. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 5. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 6. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 7. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 9. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> Some (cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')) = map_option cte_to_H (cte_lift (cte_C.cap_C_update (\<lambda>_. capa) cte')) \<and> c_valid_cte (cte_C.cap_C_update (\<lambda>_. capa) cte')
 2. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> inj cte_Ptr
 3. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 4. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 5. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 6. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 7. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 9. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; (case cap_lift (cte_C.cap_C cte') of None \<Rightarrow> None | Some cap \<Rightarrow> Some \<lparr>cap_CL = cap, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C cte')\<rparr>) = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> Some (cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')) = map_option cte_to_H (case cap_lift capa of None \<Rightarrow> None | Some cap \<Rightarrow> Some \<lparr>cap_CL = cap, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C (cte_C.cap_C_update (\<lambda>_. capa) cte'))\<rparr>) \<and> c_valid_cte (cte_C.cap_C_update (\<lambda>_. capa) cte')
 2. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> inj cte_Ptr
 3. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 4. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 5. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 6. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 7. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 9. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s' x2. \<lbrakk>cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cap_lift (cte_C.cap_C cte') = Some x2; \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C cte')\<rparr> = ctel'\<rbrakk> \<Longrightarrow> (\<exists>y. cap_lift capa = Some y) \<and> (\<forall>x2. cap_lift capa = Some x2 \<longrightarrow> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel') = cte_to_H \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C cte')\<rparr> \<and> c_valid_cte (cte_C.cap_C_update (\<lambda>_. capa) cte'))
 2. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> inj cte_Ptr
 3. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 4. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 5. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 6. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 7. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 9. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>\<sigma> x cte' p asida t cap ta capa s' x2. \<lbrakk>cl_valid_cte \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C cte')\<rparr>; cap_to_H x2 = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C cte')\<rparr>)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C cte')\<rparr>); cslift x (cte_Ptr ctSlot) = Some cte'; cap_lift (cte_C.cap_C cte') = Some x2\<rbrakk> \<Longrightarrow> (\<exists>y. cap_lift capa = Some y) \<and> (\<forall>x2a. cap_lift capa = Some x2a \<longrightarrow> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C cte')\<rparr>) = cte_to_H \<lparr>cap_CL = x2a, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C cte')\<rparr> \<and> c_valid_cte (cte_C.cap_C_update (\<lambda>_. capa) cte'))
 2. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> inj cte_Ptr
 3. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 4. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 5. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 6. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 7. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 9. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>\<sigma> x cte' p asida t cap ta capa s' x2 x1 x2a. \<lbrakk>cl_valid_cte \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C cte')\<rparr>; cap_to_H x2 = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C cte')\<rparr>)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C cte')\<rparr>); cslift x (cte_Ptr ctSlot) = Some cte'; cap_lift (cte_C.cap_C cte') = Some x2; cte' = cte_C x1 x2a\<rbrakk> \<Longrightarrow> (\<exists>y. cap_lift capa = Some y) \<and> (\<forall>x2a. cap_lift capa = Some x2a \<longrightarrow> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C cte')\<rparr>) = cte_to_H \<lparr>cap_CL = x2a, cteMDBNode_CL = mdb_node_lift (cteMDBNode_C cte')\<rparr> \<and> c_valid_cte (cte_C.cap_C_update (\<lambda>_. capa) cte'))
 2. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> inj cte_Ptr
 3. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 4. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 5. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 6. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 7. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 9. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>\<sigma> x p asida t cap ta capa s' x2 x1 x2a. \<lbrakk>cl_valid_cte \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift x2a\<rparr>; cap_to_H x2 = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift x1\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C cap x2a)) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift x1\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C capa x2a)) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C cap x2a)) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift x2a\<rparr>)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte (cte_C x1 x2a); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift x2a\<rparr>); cslift x (cte_Ptr ctSlot) = Some (cte_C x1 x2a); cap_lift x1 = Some x2\<rbrakk> \<Longrightarrow> (\<exists>y. cap_lift capa = Some y) \<and> (\<forall>x2b. cap_lift capa = Some x2b \<longrightarrow> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift x2a\<rparr>) = cte_to_H \<lparr>cap_CL = x2b, cteMDBNode_CL = mdb_node_lift x2a\<rparr> \<and> c_valid_cte (cte_C capa x2a))
 2. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> inj cte_Ptr
 3. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 4. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 5. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 6. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 7. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 9. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>\<sigma> x p asida t cap ta capa s' x2 x1 x2a. \<lbrakk>cl_valid_cte \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift x2a\<rparr>; cap_to_H x2 = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift x1\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C cap x2a)) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift x1\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C capa x2a)) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C cap x2a)) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift x2a\<rparr>)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte (cte_C x1 x2a); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift x2a\<rparr>); cslift x (cte_Ptr ctSlot) = Some (cte_C x1 x2a); cap_lift x1 = Some x2\<rbrakk> \<Longrightarrow> \<exists>y. cap_lift capa = Some y
 2. \<And>\<sigma> x p asida t cap ta capa s' x2 x1 x2a. \<lbrakk>cl_valid_cte \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift x2a\<rparr>; cap_to_H x2 = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift x1\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C cap x2a)) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift x1\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C capa x2a)) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C cap x2a)) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift x2a\<rparr>)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte (cte_C x1 x2a); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift x2a\<rparr>); cslift x (cte_Ptr ctSlot) = Some (cte_C x1 x2a); cap_lift x1 = Some x2\<rbrakk> \<Longrightarrow> \<forall>x2b. cap_lift capa = Some x2b \<longrightarrow> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift x2a\<rparr>) = cte_to_H \<lparr>cap_CL = x2b, cteMDBNode_CL = mdb_node_lift x2a\<rparr> \<and> c_valid_cte (cte_C capa x2a)
 3. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> inj cte_Ptr
 4. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 5. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 6. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 7. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 8. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 9. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 10. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>\<sigma> x p asida t cap ta capa s' x2 x1 x2a. \<lbrakk>cl_valid_cte \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift x2a\<rparr>; cap_to_H x2 = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift x1\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C cap x2a)) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift x1\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C capa x2a)) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C cap x2a)) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift x2a\<rparr>)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte (cte_C x1 x2a); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift x2a\<rparr>); cslift x (cte_Ptr ctSlot) = Some (cte_C x1 x2a); cap_lift x1 = Some x2\<rbrakk> \<Longrightarrow> \<forall>x2b. cap_lift capa = Some x2b \<longrightarrow> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift x2a\<rparr>) = cte_to_H \<lparr>cap_CL = x2b, cteMDBNode_CL = mdb_node_lift x2a\<rparr> \<and> c_valid_cte (cte_C capa x2a)
 2. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> inj cte_Ptr
 3. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 4. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 5. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 6. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 7. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 9. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>\<sigma> x p asida t cap ta capa s' x2 x1 x2a x2b. \<lbrakk>cl_valid_cte \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift x2a\<rparr>; cap_to_H x2 = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift x1\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C cap x2a)) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift x1\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C capa x2a)) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C cap x2a)) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift x2a\<rparr>)); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte (cte_C x1 x2a); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift x2a\<rparr>); cslift x (cte_Ptr ctSlot) = Some (cte_C x1 x2a); cap_lift x1 = Some x2; cap_lift capa = Some x2b\<rbrakk> \<Longrightarrow> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift x2a\<rparr>) = cte_to_H \<lparr>cap_CL = x2b, cteMDBNode_CL = mdb_node_lift x2a\<rparr> \<and> c_valid_cte (cte_C capa x2a)
 2. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> inj cte_Ptr
 3. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 4. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 5. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 6. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 7. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 9. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>\<sigma> x p asida t cap ta capa s' x2 x1 x2a x2b. \<lbrakk>cl_valid_cte \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift x2a\<rparr>; cap_to_H x2 = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift x1\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C cap x2a)) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift x1\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C capa x2a)) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C cap x2a)) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (mdb_node_to_H (mdb_node_lift x2a))); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cap x1; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida)) (mdb_node_to_H (mdb_node_lift x2a))); cslift x (cte_Ptr ctSlot) = Some (cte_C x1 x2a); cap_lift x1 = Some x2; cap_lift capa = Some x2b\<rbrakk> \<Longrightarrow> capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid)) = cap_to_H x2b
 2. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> inj cte_Ptr
 3. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 4. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 5. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 6. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 7. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 9. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>\<sigma> x p asida t cap ta capa s' x2 x1 x2a x2b. \<lbrakk>cl_valid_cte \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift x2a\<rparr>; cap_to_H x2 = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift x1\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_lift cap = Some (Cap_page_directory_cap (cap_page_directory_cap_lift x1\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>)); t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C cap x2a)) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift x1\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; x2b = Cap_page_directory_cap (cap_page_directory_cap_lift x1\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>); t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C capa x2a)) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C cap x2a)) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (mdb_node_to_H (mdb_node_lift x2a))); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cap x1; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida)) (mdb_node_to_H (mdb_node_lift x2a))); cslift x (cte_Ptr ctSlot) = Some (cte_C x1 x2a); cap_lift x1 = Some x2; cap_lift capa = Some (Cap_page_directory_cap (cap_page_directory_cap_lift x1\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>))\<rbrakk> \<Longrightarrow> capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid)) = cap_to_H (Cap_page_directory_cap (cap_page_directory_cap_lift x1\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>))
 2. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> inj cte_Ptr
 3. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 4. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 5. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 6. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 7. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 9. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>\<sigma> x p asida t cap ta capa s' x2 x1 x2a x2b. \<lbrakk>cl_valid_cte \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift x2a\<rparr>; cap_to_H x2 = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift x1\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_lift cap = Some (Cap_page_directory_cap (cap_page_directory_cap_lift x1\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>)); t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C cap x2a)) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift x1\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; x2b = Cap_page_directory_cap (cap_page_directory_cap_lift x1\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>); t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C capa x2a)) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C cap x2a)) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (mdb_node_to_H (mdb_node_lift x2a))); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cap x1; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida)) (mdb_node_to_H (mdb_node_lift x2a))); cslift x (cte_Ptr ctSlot) = Some (cte_C x1 x2a); cap_lift x1 = Some x2; cap_lift capa = Some (Cap_page_directory_cap (cap_page_directory_cap_lift x1\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>))\<rbrakk> \<Longrightarrow> p = capPDBasePtr_CL (cap_page_directory_cap_lift x1) \<and> asid = asid && mask 17
 2. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> inj cte_Ptr
 3. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 4. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 5. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 6. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 7. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 9. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>\<sigma> x p asida t cap ta capa s' x2 x1 x2a x2b. \<lbrakk>cl_valid_cte \<lparr>cap_CL = x2, cteMDBNode_CL = mdb_node_lift x2a\<rparr>; cap_to_H x2 = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift x1\<lparr>capPDMappedASID_CL := asid\<rparr>; cap_lift cap = Some (Cap_page_directory_cap (cap_page_directory_cap_lift x1\<lparr>capPDMappedASID_CL := asid\<rparr>)); t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C cap x2a)) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift x1\<lparr>capPDMappedASID_CL := asid, capPDIsMapped_CL := 1\<rparr>; x2b = Cap_page_directory_cap (cap_page_directory_cap_lift x1\<lparr>capPDMappedASID_CL := asid, capPDIsMapped_CL := 1\<rparr>); t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C capa x2a)) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C cap x2a)) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (mdb_node_to_H (mdb_node_lift x2a))); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cap x1; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; asid \<le> mask 17; ctes_of \<sigma> ctSlot = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida)) (mdb_node_to_H (mdb_node_lift x2a))); cslift x (cte_Ptr ctSlot) = Some (cte_C x1 x2a); cap_lift x1 = Some x2; cap_lift capa = Some (Cap_page_directory_cap (cap_page_directory_cap_lift x1\<lparr>capPDMappedASID_CL := asid, capPDIsMapped_CL := 1\<rparr>))\<rbrakk> \<Longrightarrow> p = capPDBasePtr_CL (cap_page_directory_cap_lift x1)
 2. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> inj cte_Ptr
 3. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 4. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 5. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 6. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 7. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 9. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> inj cte_Ptr
 2. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 3. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 4. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 5. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 6. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 7. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 8. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 10. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 2. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 3. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 4. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 5. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 6. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 7. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 9. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 10. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>))) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) (underlying_memory (ksMachineState (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) (underlying_memory (ksMachineState (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) \<and> zero_ranges_are_zero (gsUntypedZeroRanges (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) \<and> ksCurThread \<sigma> = ksCurThread (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>) \<and> ksIdleThread \<sigma> = ksIdleThread (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>) \<and> cinterrupt_relation (ksInterruptState (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cte_array_relation (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>) (globals x) \<and> tcb_cte_array_relation (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>) (globals x) \<and> gsUserPages \<sigma> = gsUserPages (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>) \<and> gsCNodes \<sigma> = gsCNodes (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>) \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>) \<and> cdom_schedule_relation (kernel_state.ksDomSchedule (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)) \<and> ksCurDomain \<sigma> = ksCurDomain (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>) \<and> ksDomainTime \<sigma> = ksDomainTime (\<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>)
 2. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 3. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 4. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 5. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 6. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 7. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 9. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 10. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (\<lambda>p. map_option (\<lambda>_. byte_to_word_heap (underlying_memory (ksMachineState \<sigma>)) p) (map_to_user_data (ksPSpace s') p)) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> tcb_cte_array_relation s' (globals x)
 2. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 3. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 4. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 5. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 6. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 7. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 9. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 10. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (\<lambda>p. map_option (\<lambda>_. byte_to_word_heap (underlying_memory (ksMachineState \<sigma>)) p) (map_to_user_data (ksPSpace s') p)) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation
 2. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (\<lambda>p. map_option (\<lambda>_. byte_to_word_heap (underlying_memory (ksMachineState \<sigma>)) p) (map_to_user_data (ksPSpace s') p)) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> tcb_cte_array_relation s' (globals x)
 3. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 4. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 5. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 6. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 7. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 8. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 10. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>\<sigma> x cte' ctel' p asida t cap ta capa s'. \<lbrakk>asid \<le> mask local.asid_bits; ctes_of \<sigma> ctSlot = Some (cte_to_H ctel'); cslift x (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; cap_to_H (cap_CL ctel') = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C cte')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x))); ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (arch_capability.PageDirectoryCap p (Some asid))) (cte_to_H ctel')); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; c_valid_cte cte'; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (\<lambda>p. map_option (\<lambda>_. byte_to_word_heap (underlying_memory (ksMachineState \<sigma>)) p) (map_to_user_data (ksPSpace s') p)) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+4096} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals x)))\<rparr>) \<and> tcb_cte_array_relation s' (globals x)
 2. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 3. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 4. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 5. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 6. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 7. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 9. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 10. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap pool s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cte. ctes_of s ctSlot = Some cte \<longrightarrow> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asid \<le> mask local.asid_bits) and cte_wp_at' ((=) cte) ctSlot) s) \<and> s' \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr ctSlot) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}
 2. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 3. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 4. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 5. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 6. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 9. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 pdCapSlot asida poolPtra\<rbrace> getSlotCap ctSlot \<lbrace>?Q497 pdCapSlot asida poolPtra\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap pool rv' t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 2. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (?d'510 pdCapSlot asida poolPtra oldcap pool rv')
 3. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 4. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 5. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 7. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 8. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 pdCapSlot asida poolPtra\<rbrace> getSlotCap ctSlot \<lbrace>?Q497 pdCapSlot asida poolPtra\<rbrace>
 10. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap ctSlot)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q510 pdCapSlot asida poolPtra oldcap pool y) (?Q'510 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>?Q510 pdCapSlot asida poolPtra oldcap pool\<rbrace>
 3. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'510 pdCapSlot asida poolPtra oldcap pool y (xfdc s)}
 4. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 6. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 7. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 pdCapSlot asida poolPtra\<rbrace> getSlotCap ctSlot \<lbrace>?Q497 pdCapSlot asida poolPtra\<rbrace>
 9. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap ctSlot)
 10. \<And>pdCapSlot asida poolPtra s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (isPDCap \<circ> cteCap) ctSlot and asid_pool_at' poolPtr and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q491 pdCapSlot asida poolPtra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ?Q497 pdCapSlot asida poolPtra rv s \<longrightarrow> s' \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (ko_at' (asidpool.ASIDPool rva) poolPtr and (cte_wp_at' ((=) rv \<circ> cteCap) ctSlot and K (isPDCap rv \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra rv rva)) s \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ko_at' (asidpool.ASIDPool rva) poolPtr s \<longrightarrow> s' \<in> UNIV \<inter> ?R'510 pdCapSlot asida poolPtra rv rva}}} proof (prove)
goal (10 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?A752 pdCapSlot asida poolPtra oldcap pool y) (?C'751 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])));;
(Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>\<lambda>y. ?A752 pdCapSlot asida poolPtra oldcap pool y and cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot)\<rbrace>
 3. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?C'751 pdCapSlot asida poolPtra oldcap pool y (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 4. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 6. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 7. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 pdCapSlot asida poolPtra\<rbrace> getSlotCap ctSlot \<lbrace>?Q497 pdCapSlot asida poolPtra\<rbrace>
 9. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap ctSlot)
 10. \<And>pdCapSlot asida poolPtra s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (isPDCap \<circ> cteCap) ctSlot and asid_pool_at' poolPtr and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q491 pdCapSlot asida poolPtra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ?Q497 pdCapSlot asida poolPtra rv s \<longrightarrow> s' \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (ko_at' (asidpool.ASIDPool rva) poolPtr and (cte_wp_at' ((=) rv \<circ> cteCap) ctSlot and K (isPDCap rv \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra rv rva)) s \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ko_at' (asidpool.ASIDPool rva) poolPtr s \<longrightarrow> s' \<in> UNIV \<inter> ?R'510 pdCapSlot asida poolPtra rv rva}}} proof (prove)
goal (12 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?A752 pdCapSlot asida poolPtra oldcap pool y) (?Q'755 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (Guard ArrayBounds \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'751 pdCapSlot asida poolPtra oldcap pool y rv') \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) (?Q'755 pdCapSlot asida poolPtra oldcap pool y rv')
 3. \<And>pdCapSlot asida poolPtra oldcap pool y rv' s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'; ?A752 pdCapSlot asida poolPtra oldcap pool y s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'751 pdCapSlot asida poolPtra oldcap pool y rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 4. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>\<lambda>y. ?A752 pdCapSlot asida poolPtra oldcap pool y and cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot)\<rbrace>
 5. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?C'751 pdCapSlot asida poolPtra oldcap pool y (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 6. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 9. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 pdCapSlot asida poolPtra\<rbrace> getSlotCap ctSlot \<lbrace>?Q497 pdCapSlot asida poolPtra\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?A752 pdCapSlot asida poolPtra oldcap pool y) (?C'759 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (Guard C_Guard {s. s \<Turnstile>\<^sub>c poolPtra} (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned)))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'751 pdCapSlot asida poolPtra oldcap pool y rv') \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) (?C'759 pdCapSlot asida poolPtra oldcap pool y rv' \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>)
 3. \<And>pdCapSlot asida poolPtra oldcap pool y rv' s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'; ?A752 pdCapSlot asida poolPtra oldcap pool y s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'751 pdCapSlot asida poolPtra oldcap pool y rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 4. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>\<lambda>y. ?A752 pdCapSlot asida poolPtra oldcap pool y and cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot)\<rbrace>
 5. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?C'751 pdCapSlot asida poolPtra oldcap pool y (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 6. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 9. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 pdCapSlot asida poolPtra\<rbrace> getSlotCap ctSlot \<lbrace>?Q497 pdCapSlot asida poolPtra\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?A762 pdCapSlot asida poolPtra oldcap pool y) (?C'761 pdCapSlot asida poolPtra oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'751 pdCapSlot asida poolPtra oldcap pool y rv') \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) (?C'761 pdCapSlot asida poolPtra oldcap pool y rv' \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>)
 3. \<And>pdCapSlot asida poolPtra oldcap pool y rv' s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'; (?A762 pdCapSlot asida poolPtra oldcap pool y and asid_pool_at' (ptr_val poolPtra)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'751 pdCapSlot asida poolPtra oldcap pool y rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 4. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>\<lambda>y. ?A762 pdCapSlot asida poolPtra oldcap pool y and asid_pool_at' (ptr_val poolPtra) and cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot)\<rbrace>
 5. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?C'751 pdCapSlot asida poolPtra oldcap pool y (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 6. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 9. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 pdCapSlot asida poolPtra\<rbrace> getSlotCap ctSlot \<lbrace>?Q497 pdCapSlot asida poolPtra\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?A762 (cte_Ptr ctSlot) asid (ap_Ptr poolPtr) oldcap pool y) (?C'761 (cte_Ptr ctSlot) asid (ap_Ptr poolPtr) oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (Guard ShiftError \<lbrace>sint 0 \<le> sint 0xA\<rbrace> (Guard ShiftError \<lbrace>0xA <s 0x20\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr poolPtr\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr poolPtr\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'751 pdCapSlot asida poolPtra oldcap pool y rv') \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) (?C'761 pdCapSlot asida poolPtra oldcap pool y rv' \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>)
 3. \<And>pdCapSlot asida poolPtra oldcap pool y rv' s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'; (?A762 pdCapSlot asida poolPtra oldcap pool y and asid_pool_at' (ptr_val poolPtra)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'751 pdCapSlot asida poolPtra oldcap pool y rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 4. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>\<lambda>y. ?A762 pdCapSlot asida poolPtra oldcap pool y and asid_pool_at' (ptr_val poolPtra) and cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot)\<rbrace>
 5. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?C'751 pdCapSlot asida poolPtra oldcap pool y (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 6. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 9. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 pdCapSlot asida poolPtra\<rbrace> getSlotCap ctSlot \<lbrace>?Q497 pdCapSlot asida poolPtra\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?A762 (cte_Ptr ctSlot) asid (ap_Ptr poolPtr) oldcap pool y) (?C'771 (cte_Ptr ctSlot) asid (ap_Ptr poolPtr) oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr poolPtr\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr poolPtr\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'751 pdCapSlot asida poolPtra oldcap pool y rv') \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) (?C'771 pdCapSlot asida poolPtra oldcap pool y rv' \<inter> \<lbrace>0xA <s 0x20\<rbrace> \<inter> \<lbrace>sint 0 \<le> sint 0xA\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>)
 3. \<And>pdCapSlot asida poolPtra oldcap pool y rv' s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'; (?A762 pdCapSlot asida poolPtra oldcap pool y and asid_pool_at' (ptr_val poolPtra)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'751 pdCapSlot asida poolPtra oldcap pool y rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 4. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>\<lambda>y. ?A762 pdCapSlot asida poolPtra oldcap pool y and asid_pool_at' (ptr_val poolPtra) and cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot)\<rbrace>
 5. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?C'751 pdCapSlot asida poolPtra oldcap pool y (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 6. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 9. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 pdCapSlot asida poolPtra\<rbrace> getSlotCap ctSlot \<lbrace>?Q497 pdCapSlot asida poolPtra\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?A762 (cte_Ptr ctSlot) asid (ap_Ptr poolPtr) oldcap pool y) (?C'771 (cte_Ptr ctSlot) asid (ap_Ptr poolPtr) oldcap pool y rv') [SKIP] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap)))) >>= return) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr poolPtr\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr poolPtr\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'751 pdCapSlot asida poolPtra oldcap pool y rv') \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) (?C'771 pdCapSlot asida poolPtra oldcap pool y rv' \<inter> \<lbrace>0xA <s 0x20\<rbrace> \<inter> \<lbrace>sint 0 \<le> sint 0xA\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>)
 3. \<And>pdCapSlot asida poolPtra oldcap pool y rv' s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'; (?A762 pdCapSlot asida poolPtra oldcap pool y and asid_pool_at' (ptr_val poolPtra)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'751 pdCapSlot asida poolPtra oldcap pool y rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 4. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>\<lambda>y. ?A762 pdCapSlot asida poolPtra oldcap pool y and asid_pool_at' (ptr_val poolPtra) and cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot)\<rbrace>
 5. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?C'751 pdCapSlot asida poolPtra oldcap pool y (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 6. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 9. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 pdCapSlot asida poolPtra\<rbrace> getSlotCap ctSlot \<lbrace>?Q497 pdCapSlot asida poolPtra\<rbrace>
A total of 12 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (?r'779 pdCapSlot asida poolPtra oldcap pool y rv') (?xf'779 pdCapSlot asida poolPtra oldcap pool y rv') (?P786 (cte_Ptr ctSlot) asid (ap_Ptr poolPtr) oldcap pool y) (?C'771 (cte_Ptr ctSlot) asid (ap_Ptr poolPtr) oldcap pool y rv') [] (setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap))))) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(pde_C ptr[1024]) &(ap_Ptr poolPtr\<rightarrow>[''array_C''])) (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(ap_Ptr poolPtr\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned)))))
 2. \<And>pdCapSlot asida poolPtra oldcap pool y rv' rv'a t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'779 pdCapSlot asida poolPtra oldcap pool y rv') rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'779 pdCapSlot asida poolPtra oldcap pool y rv' rv'a)
 3. \<And>pdCapSlot asida poolPtra oldcap pool y rv' x rv'a. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'; ?r'779 pdCapSlot asida poolPtra oldcap pool y rv' x rv'a\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q779 pdCapSlot asida poolPtra oldcap pool y rv' x) (?Q'779 pdCapSlot asida poolPtra oldcap pool y rv' x rv'a) [SKIP] (return x) (?d'779 pdCapSlot asida poolPtra oldcap pool y rv' rv'a)
 4. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R784 (cte_Ptr ctSlot) asid (ap_Ptr poolPtr) oldcap pool y\<rbrace> setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap)))) \<lbrace>?Q779 pdCapSlot asida poolPtra oldcap pool y rv'\<rbrace>
 5. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'779 pdCapSlot asida poolPtra oldcap pool y rv') (?xf'779 pdCapSlot asida poolPtra oldcap pool y rv') (?Q'779 pdCapSlot asida poolPtra oldcap pool y rv')
 6. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'751 pdCapSlot asida poolPtra oldcap pool y rv') \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) (?C'771 pdCapSlot asida poolPtra oldcap pool y rv' \<inter> \<lbrace>0xA <s 0x20\<rbrace> \<inter> \<lbrace>sint 0 \<le> sint 0xA\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>)
 7. \<And>pdCapSlot asida poolPtra oldcap pool y rv' s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'; (?P786 pdCapSlot asida poolPtra oldcap pool y and ?R784 pdCapSlot asida poolPtra oldcap pool y and asid_pool_at' (ptr_val poolPtra)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'751 pdCapSlot asida poolPtra oldcap pool y rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 8. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>\<lambda>y. ?P786 pdCapSlot asida poolPtra oldcap pool y and ?R784 pdCapSlot asida poolPtra oldcap pool y and asid_pool_at' (ptr_val poolPtra) and cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot)\<rbrace>
 9. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?C'751 pdCapSlot asida poolPtra oldcap pool y (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 10. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap pool y rv' rv'a t t'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'779 pdCapSlot asida poolPtra oldcap pool y rv' rv'a)
 2. \<And>pdCapSlot asida poolPtra oldcap pool y rv' x rv'a. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'; dc x rv'a\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q779 pdCapSlot asida poolPtra oldcap pool y rv' x) (?Q'779 pdCapSlot asida poolPtra oldcap pool y rv' x rv'a) [SKIP] (return x) (?d'779 pdCapSlot asida poolPtra oldcap pool y rv' rv'a)
 3. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R784 (cte_Ptr ctSlot) asid (ap_Ptr poolPtr) oldcap pool y\<rbrace> setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap)))) \<lbrace>?Q779 pdCapSlot asida poolPtra oldcap pool y rv'\<rbrace>
 4. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'779 pdCapSlot asida poolPtra oldcap pool y rv')
 5. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'751 pdCapSlot asida poolPtra oldcap pool y rv') \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) (\<lbrace>poolPtr = poolPtr \<and> casid_pool_relation (asidpool.ASIDPool (pool(asida && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap)))) (asid_pool_C.asid_pool_C (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned)))\<rbrace> \<inter> \<lbrace>0xA <s 0x20\<rbrace> \<inter> \<lbrace>sint 0 \<le> sint 0xA\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>)
 6. \<And>pdCapSlot asida poolPtra oldcap pool y rv' s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'; ((\<lambda>a. True) and ?R784 pdCapSlot asida poolPtra oldcap pool y and asid_pool_at' (ptr_val poolPtra)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'751 pdCapSlot asida poolPtra oldcap pool y rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 7. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>\<lambda>y. (\<lambda>a. True) and ?R784 pdCapSlot asida poolPtra oldcap pool y and asid_pool_at' (ptr_val poolPtra) and cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot)\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?C'751 pdCapSlot asida poolPtra oldcap pool y (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 9. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap pool y rv' x rv'a. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'; dc x rv'a\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q779 pdCapSlot asida poolPtra oldcap pool y rv' x) (?Q'779 pdCapSlot asida poolPtra oldcap pool y rv' x rv'a) [SKIP] (return x) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R784 (cte_Ptr ctSlot) asid (ap_Ptr poolPtr) oldcap pool y\<rbrace> setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap)))) \<lbrace>?Q779 pdCapSlot asida poolPtra oldcap pool y rv'\<rbrace>
 3. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'779 pdCapSlot asida poolPtra oldcap pool y rv')
 4. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'751 pdCapSlot asida poolPtra oldcap pool y rv') \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) (\<lbrace>poolPtr = poolPtr \<and> casid_pool_relation (asidpool.ASIDPool (pool(asida && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap)))) (asid_pool_C.asid_pool_C (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned)))\<rbrace> \<inter> \<lbrace>0xA <s 0x20\<rbrace> \<inter> \<lbrace>sint 0 \<le> sint 0xA\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>)
 5. \<And>pdCapSlot asida poolPtra oldcap pool y rv' s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'; ((\<lambda>a. True) and ?R784 pdCapSlot asida poolPtra oldcap pool y and asid_pool_at' (ptr_val poolPtra)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'751 pdCapSlot asida poolPtra oldcap pool y rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 6. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>\<lambda>y. (\<lambda>a. True) and ?R784 pdCapSlot asida poolPtra oldcap pool y and asid_pool_at' (ptr_val poolPtra) and cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot)\<rbrace>
 7. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?C'751 pdCapSlot asida poolPtra oldcap pool y (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 8. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 10. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap pool y rv' x rv'a. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'; dc x rv'a\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return x \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R784 (cte_Ptr ctSlot) asid (ap_Ptr poolPtr) oldcap pool y\<rbrace> setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap)))) \<lbrace>\<lambda>x _. True\<rbrace>
 3. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>x rv'a. UNIV)
 4. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'751 pdCapSlot asida poolPtra oldcap pool y rv') \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) (\<lbrace>poolPtr = poolPtr \<and> casid_pool_relation (asidpool.ASIDPool (pool(asida && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap)))) (asid_pool_C.asid_pool_C (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned)))\<rbrace> \<inter> \<lbrace>0xA <s 0x20\<rbrace> \<inter> \<lbrace>sint 0 \<le> sint 0xA\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>)
 5. \<And>pdCapSlot asida poolPtra oldcap pool y rv' s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'; ((\<lambda>a. True) and ?R784 pdCapSlot asida poolPtra oldcap pool y and asid_pool_at' (ptr_val poolPtra)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'751 pdCapSlot asida poolPtra oldcap pool y rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 6. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>\<lambda>y. (\<lambda>a. True) and ?R784 pdCapSlot asida poolPtra oldcap pool y and asid_pool_at' (ptr_val poolPtra) and cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot)\<rbrace>
 7. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?C'751 pdCapSlot asida poolPtra oldcap pool y (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 8. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 10. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap pool y rv' x rv'a \<sigma>. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'; dc x rv'a\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return x \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (K (K (\<lambda>_. False)) \<currency> dc) (Inr rv) (liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>))}
 2. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R784 (cte_Ptr ctSlot) asid (ap_Ptr poolPtr) oldcap pool y\<rbrace> setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap)))) \<lbrace>\<lambda>x _. True\<rbrace>
 3. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>x rv'a. UNIV)
 4. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'751 pdCapSlot asida poolPtra oldcap pool y rv') \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) (\<lbrace>poolPtr = poolPtr \<and> casid_pool_relation (asidpool.ASIDPool (pool(asida && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap)))) (asid_pool_C.asid_pool_C (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned)))\<rbrace> \<inter> \<lbrace>0xA <s 0x20\<rbrace> \<inter> \<lbrace>sint 0 \<le> sint 0xA\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>)
 5. \<And>pdCapSlot asida poolPtra oldcap pool y rv' s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'; ((\<lambda>a. True) and ?R784 pdCapSlot asida poolPtra oldcap pool y and asid_pool_at' (ptr_val poolPtra)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'751 pdCapSlot asida poolPtra oldcap pool y rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 6. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>\<lambda>y. (\<lambda>a. True) and ?R784 pdCapSlot asida poolPtra oldcap pool y and asid_pool_at' (ptr_val poolPtra) and cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot)\<rbrace>
 7. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?C'751 pdCapSlot asida poolPtra oldcap pool y (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 8. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 10. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R784 (cte_Ptr ctSlot) asid (ap_Ptr poolPtr) oldcap pool y\<rbrace> setObject poolPtr (asidpool.ASIDPool (pool(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap)))) \<lbrace>\<lambda>x _. True\<rbrace>
 2. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>x rv'a. UNIV)
 3. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'751 pdCapSlot asida poolPtra oldcap pool y rv') \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) (\<lbrace>poolPtr = poolPtr \<and> casid_pool_relation (asidpool.ASIDPool (pool(asida && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap)))) (asid_pool_C.asid_pool_C (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned)))\<rbrace> \<inter> \<lbrace>0xA <s 0x20\<rbrace> \<inter> \<lbrace>sint 0 \<le> sint 0xA\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>)
 4. \<And>pdCapSlot asida poolPtra oldcap pool y rv' s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'; ((\<lambda>a. True) and ?R784 pdCapSlot asida poolPtra oldcap pool y and asid_pool_at' (ptr_val poolPtra)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'751 pdCapSlot asida poolPtra oldcap pool y rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 5. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>\<lambda>y. (\<lambda>a. True) and ?R784 pdCapSlot asida poolPtra oldcap pool y and asid_pool_at' (ptr_val poolPtra) and cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot)\<rbrace>
 6. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?C'751 pdCapSlot asida poolPtra oldcap pool y (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 7. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 9. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 10. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>x rv'a. UNIV)
 2. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'751 pdCapSlot asida poolPtra oldcap pool y rv') \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) (\<lbrace>poolPtr = poolPtr \<and> casid_pool_relation (asidpool.ASIDPool (pool(asida && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap)))) (asid_pool_C.asid_pool_C (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned)))\<rbrace> \<inter> \<lbrace>0xA <s 0x20\<rbrace> \<inter> \<lbrace>sint 0 \<le> sint 0xA\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>)
 3. \<And>pdCapSlot asida poolPtra oldcap pool y rv' s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'; ((\<lambda>a. True) and (\<lambda>a. True) and asid_pool_at' (ptr_val poolPtra)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'751 pdCapSlot asida poolPtra oldcap pool y rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 4. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>\<lambda>y. (\<lambda>a. True) and (\<lambda>a. True) and asid_pool_at' (ptr_val poolPtra) and cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot)\<rbrace>
 5. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?C'751 pdCapSlot asida poolPtra oldcap pool y (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 6. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 8. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 9. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 pdCapSlot asida poolPtra\<rbrace> getSlotCap ctSlot \<lbrace>?Q497 pdCapSlot asida poolPtra\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap pool y rv'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'751 pdCapSlot asida poolPtra oldcap pool y rv') \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) (\<lbrace>poolPtr = poolPtr \<and> casid_pool_relation (asidpool.ASIDPool (pool(asida && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap)))) (asid_pool_C.asid_pool_C (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr \<acute>ret__unsigned)))\<rbrace> \<inter> \<lbrace>0xA <s 0x20\<rbrace> \<inter> \<lbrace>sint 0 \<le> sint 0xA\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>asida && 2 ^ local.asid_low_bits - 1 < 0x400\<rbrace>)
 2. \<And>pdCapSlot asida poolPtra oldcap pool y rv' s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'; ((\<lambda>a. True) and (\<lambda>a. True) and asid_pool_at' (ptr_val poolPtra)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'751 pdCapSlot asida poolPtra oldcap pool y rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 3. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>\<lambda>y. (\<lambda>a. True) and (\<lambda>a. True) and asid_pool_at' (ptr_val poolPtra) and cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot)\<rbrace>
 4. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?C'751 pdCapSlot asida poolPtra oldcap pool y (xfdc s) \<inter> \<lbrace>True\<rbrace>}
 5. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 7. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 8. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 pdCapSlot asida poolPtra\<rbrace> getSlotCap ctSlot \<lbrace>?Q497 pdCapSlot asida poolPtra\<rbrace>
 10. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap ctSlot)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap pool y rv' s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'; ((\<lambda>a. True) and (\<lambda>a. True) and asid_pool_at' (ptr_val poolPtra)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))) \<longrightarrow> casid_pool_relation (asidpool.ASIDPool (pool(asida && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap)))) (asid_pool_C.asid_pool_C (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr (capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))))))) \<and> 0xA <s 0x20 \<and> sint 0 \<le> sint 0xA \<and> asida && 2 ^ local.asid_low_bits - 1 < 0x400)\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 2. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>\<lambda>y. (\<lambda>a. True) and (\<lambda>a. True) and asid_pool_at' (ptr_val poolPtra) and cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot)\<rbrace>
 3. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> \<lbrace>cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))) \<longrightarrow> casid_pool_relation (asidpool.ASIDPool (pool(asida && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap)))) (asid_pool_C.asid_pool_C (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr (capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))))))) \<and> 0xA <s 0x20 \<and> sint 0 \<le> sint 0xA \<and> asida && 2 ^ local.asid_low_bits - 1 < 0x400)\<rbrace> \<inter> \<lbrace>True\<rbrace>}
 4. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 6. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 7. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 pdCapSlot asida poolPtra\<rbrace> getSlotCap ctSlot \<lbrace>?Q497 pdCapSlot asida poolPtra\<rbrace>
 9. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap ctSlot)
 10. \<And>pdCapSlot asida poolPtra s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (isPDCap \<circ> cteCap) ctSlot and asid_pool_at' poolPtr and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q491 pdCapSlot asida poolPtra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ?Q497 pdCapSlot asida poolPtra rv s \<longrightarrow> s' \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (ko_at' (asidpool.ASIDPool rva) poolPtr and (cte_wp_at' ((=) rv \<circ> cteCap) ctSlot and K (isPDCap rv \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra rv rva)) s \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ko_at' (asidpool.ASIDPool rva) poolPtr s \<longrightarrow> s' \<in> UNIV \<inter> ?R'510 pdCapSlot asida poolPtra rv rva}}} proof (prove)
goal (10 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap pool y rv' s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; dc y rv'; ((\<lambda>a. True) and (\<lambda>a. True) and asid_pool_at' (ptr_val poolPtra)) s\<rbrakk> \<Longrightarrow> \<lbrace>cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))) \<longrightarrow> casid_pool_relation (asidpool.ASIDPool (pool(asida && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap)))) (asid_pool_C.asid_pool_C (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr (capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))))))) \<and> 0xA <s 0x20 \<and> sint 0 \<le> sint 0xA \<and> asida && 2 ^ local.asid_low_bits - 1 < 0x400)\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))) \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))))\<rparr>) \<in> rf_sr)}
 2. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>\<lambda>y. (\<lambda>a. True) and (\<lambda>a. True) and asid_pool_at' (ptr_val poolPtra) and cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot)\<rbrace>
 3. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> \<lbrace>cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))) \<longrightarrow> casid_pool_relation (asidpool.ASIDPool (pool(asida && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap)))) (asid_pool_C.asid_pool_C (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr (capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))))))) \<and> 0xA <s 0x20 \<and> sint 0 \<le> sint 0xA \<and> asida && 2 ^ local.asid_low_bits - 1 < 0x400)\<rbrace> \<inter> \<lbrace>True\<rbrace>}
 4. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 6. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 7. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 pdCapSlot asida poolPtra\<rbrace> getSlotCap ctSlot \<lbrace>?Q497 pdCapSlot asida poolPtra\<rbrace>
 9. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap ctSlot)
 10. \<And>pdCapSlot asida poolPtra s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (isPDCap \<circ> cteCap) ctSlot and asid_pool_at' poolPtr and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q491 pdCapSlot asida poolPtra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ?Q497 pdCapSlot asida poolPtra rv s \<longrightarrow> s' \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (ko_at' (asidpool.ASIDPool rva) poolPtr and (cte_wp_at' ((=) rv \<circ> cteCap) ctSlot and K (isPDCap rv \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra rv rva)) s \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ko_at' (asidpool.ASIDPool rva) poolPtr s \<longrightarrow> s' \<in> UNIV \<inter> ?R'510 pdCapSlot asida poolPtra rv rva}}} proof (prove)
goal (9 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?R510 pdCapSlot asida poolPtra oldcap pool\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capPDMappedASID_update (\<lambda>_. Some asid) (capCap oldcap))) \<lbrace>\<lambda>y. (\<lambda>a. True) and (\<lambda>a. True) and asid_pool_at' (ptr_val poolPtra) and cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot)\<rbrace>
 2. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> \<lbrace>cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))) \<longrightarrow> casid_pool_relation (asidpool.ASIDPool (pool(asida && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap)))) (asid_pool_C.asid_pool_C (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr (capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))))))) \<and> 0xA <s 0x20 \<and> sint 0 \<le> sint 0xA \<and> asida && 2 ^ local.asid_low_bits - 1 < 0x400)\<rbrace> \<inter> \<lbrace>True\<rbrace>}
 3. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra oldcap pool)\<rbrace>
 5. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 6. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 pdCapSlot asida poolPtra\<rbrace> getSlotCap ctSlot \<lbrace>?Q497 pdCapSlot asida poolPtra\<rbrace>
 8. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap ctSlot)
 9. \<And>pdCapSlot asida poolPtra s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (isPDCap \<circ> cteCap) ctSlot and asid_pool_at' poolPtr and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q491 pdCapSlot asida poolPtra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ?Q497 pdCapSlot asida poolPtra rv s \<longrightarrow> s' \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (ko_at' (asidpool.ASIDPool rva) poolPtr and (cte_wp_at' ((=) rv \<circ> cteCap) ctSlot and K (isPDCap rv \<and> asida \<le> mask local.asid_bits) and ?R510 pdCapSlot asida poolPtra rv rva)) s \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ko_at' (asidpool.ASIDPool rva) poolPtr s \<longrightarrow> s' \<in> UNIV \<inter> ?R'510 pdCapSlot asida poolPtra rv rva}}} proof (prove)
goal (8 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap pool. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F510 pdCapSlot asida poolPtra oldcap pool\<^esub> (?R'510 pdCapSlot asida poolPtra oldcap pool) Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDMappedASID_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) asida));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c pdCapSlot} (CALL cap_page_directory_cap_ptr_set_capPDIsMapped_'proc(cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 1)) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> \<lbrace>cap_get_tag (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. \<^bsup>t\<^esup>ret__unsigned = capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))) \<longrightarrow> casid_pool_relation (asidpool.ASIDPool (pool(asida && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap oldcap)))) (asid_pool_C.asid_pool_C (Arrays.update (h_val (hrs_mem \<acute>t_hrs) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr (capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))))))) \<and> 0xA <s 0x20 \<and> sint 0 \<le> sint 0xA \<and> asida && 2 ^ local.asid_low_bits - 1 < 0x400)\<rbrace> \<inter> \<lbrace>True\<rbrace>}
 2. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. True \<and> True \<and> asid_pool_at' (ptr_val poolPtra) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot) s))\<rbrace>
 4. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 5. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 pdCapSlot asida poolPtra\<rbrace> getSlotCap ctSlot \<lbrace>?Q497 pdCapSlot asida poolPtra\<rbrace>
 7. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap ctSlot)
 8. \<And>pdCapSlot asida poolPtra s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (isPDCap \<circ> cteCap) ctSlot and asid_pool_at' poolPtr and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q491 pdCapSlot asida poolPtra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ?Q497 pdCapSlot asida poolPtra rv s \<longrightarrow> s' \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (ko_at' (asidpool.ASIDPool rva) poolPtr and (cte_wp_at' ((=) rv \<circ> cteCap) ctSlot and K (isPDCap rv \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. True \<and> True \<and> asid_pool_at' (ptr_val poolPtra) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot) s))) s \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ko_at' (asidpool.ASIDPool rva) poolPtr s \<longrightarrow> s' \<in> UNIV \<inter> ?R'510 pdCapSlot asida poolPtra rv rva}}} proof (prove)
goal (7 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. True \<and> True \<and> asid_pool_at' (ptr_val poolPtra) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot) s))\<rbrace>
 3. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 4. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 pdCapSlot asida poolPtra\<rbrace> getSlotCap ctSlot \<lbrace>?Q497 pdCapSlot asida poolPtra\<rbrace>
 6. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap ctSlot)
 7. \<And>pdCapSlot asida poolPtra s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (isPDCap \<circ> cteCap) ctSlot and asid_pool_at' poolPtr and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q491 pdCapSlot asida poolPtra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ?Q497 pdCapSlot asida poolPtra rv s \<longrightarrow> s' \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (ko_at' (asidpool.ASIDPool rva) poolPtr and (cte_wp_at' ((=) rv \<circ> cteCap) ctSlot and K (isPDCap rv \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. True \<and> True \<and> asid_pool_at' (ptr_val poolPtra) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot) s))) s \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ko_at' (asidpool.ASIDPool rva) poolPtr s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c pdCapSlot \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capPDMappedASID_CL := UCAST(32 \<rightarrow> 32) asida && mask 17\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c pdCapSlot \<longrightarrow> t \<Turnstile>\<^sub>c cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>ta. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capPDIsMapped_CL := SCAST(32 signed \<rightarrow> 32) 1 && mask 1\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>y. dc y (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>)) \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))) \<longrightarrow> casid_pool_relation (asidpool.ASIDPool (rva(asida && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap rv)))) (asid_pool_C.asid_pool_C (Arrays.update (h_val (hrs_mem (t_hrs_' (globals ta))) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr (capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))))))) \<and> 0xA <s 0x20 \<and> sint 0 \<le> sint 0xA \<and> asida && 2 ^ local.asid_low_bits - 1 < 0x400))))}}}} proof (prove)
goal (7 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap s sa. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; s = sa\<rbrakk> \<Longrightarrow> \<forall>ko. ko_at' ko poolPtr sa \<longrightarrow> ((\<lambda>r. (=) s) \<circ> inv asidpool.ASIDPool) ko sa
 2. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. True \<and> True \<and> asid_pool_at' (ptr_val poolPtra) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot) s))\<rbrace>
 3. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 4. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 pdCapSlot asida poolPtra\<rbrace> getSlotCap ctSlot \<lbrace>?Q497 pdCapSlot asida poolPtra\<rbrace>
 6. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap ctSlot)
 7. \<And>pdCapSlot asida poolPtra s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (isPDCap \<circ> cteCap) ctSlot and asid_pool_at' poolPtr and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q491 pdCapSlot asida poolPtra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ?Q497 pdCapSlot asida poolPtra rv s \<longrightarrow> s' \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (ko_at' (asidpool.ASIDPool rva) poolPtr and (cte_wp_at' ((=) rv \<circ> cteCap) ctSlot and K (isPDCap rv \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. True \<and> True \<and> asid_pool_at' (ptr_val poolPtra) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot) s))) s \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ko_at' (asidpool.ASIDPool rva) poolPtr s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c pdCapSlot \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capPDMappedASID_CL := UCAST(32 \<rightarrow> 32) asida && mask 17\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c pdCapSlot \<longrightarrow> t \<Turnstile>\<^sub>c cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>ta. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capPDIsMapped_CL := SCAST(32 signed \<rightarrow> 32) 1 && mask 1\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>y. dc y (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>)) \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))) \<longrightarrow> casid_pool_relation (asidpool.ASIDPool (rva(asida && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap rv)))) (asid_pool_C.asid_pool_C (Arrays.update (h_val (hrs_mem (t_hrs_' (globals ta))) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr (capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))))))) \<and> 0xA <s 0x20 \<and> sint 0 \<le> sint 0xA \<and> asida && 2 ^ local.asid_low_bits - 1 < 0x400))))}}}} proof (prove)
goal (6 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> liftM (inv asidpool.ASIDPool) (getObject poolPtr) \<lbrace>\<lambda>pool. ko_at' (asidpool.ASIDPool pool) poolPtr and (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. True \<and> True \<and> asid_pool_at' (ptr_val poolPtra) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot) s))\<rbrace>
 2. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 3. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 pdCapSlot asida poolPtra\<rbrace> getSlotCap ctSlot \<lbrace>?Q497 pdCapSlot asida poolPtra\<rbrace>
 5. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap ctSlot)
 6. \<And>pdCapSlot asida poolPtra s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (isPDCap \<circ> cteCap) ctSlot and asid_pool_at' poolPtr and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q491 pdCapSlot asida poolPtra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ?Q497 pdCapSlot asida poolPtra rv s \<longrightarrow> s' \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (ko_at' (asidpool.ASIDPool rva) poolPtr and (cte_wp_at' ((=) rv \<circ> cteCap) ctSlot and K (isPDCap rv \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. True \<and> True \<and> asid_pool_at' (ptr_val poolPtra) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot) s))) s \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ko_at' (asidpool.ASIDPool rva) poolPtr s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c pdCapSlot \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capPDMappedASID_CL := UCAST(32 \<rightarrow> 32) asida && mask 17\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c pdCapSlot \<longrightarrow> t \<Turnstile>\<^sub>c cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>ta. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capPDIsMapped_CL := SCAST(32 signed \<rightarrow> 32) 1 && mask 1\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>y. dc y (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>)) \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))) \<longrightarrow> casid_pool_relation (asidpool.ASIDPool (rva(asida && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap rv)))) (asid_pool_C.asid_pool_C (Arrays.update (h_val (hrs_mem (t_hrs_' (globals ta))) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr (capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))))))) \<and> 0xA <s 0x20 \<and> sint 0 \<le> sint 0xA \<and> asida && 2 ^ local.asid_low_bits - 1 < 0x400))))}}}} proof (prove)
goal (6 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 pdCapSlot asida poolPtra oldcap\<rbrace> getObject poolPtr \<lbrace>(\<lambda>pool s. ko_at' (asidpool.ASIDPool pool) poolPtr s \<and> (cte_wp_at' ((=) oldcap \<circ> cteCap) ctSlot and K (isPDCap oldcap \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. True \<and> True \<and> asid_pool_at' (ptr_val poolPtra) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot) s)) s) \<circ> inv asidpool.ASIDPool\<rbrace>
 2. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 3. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 pdCapSlot asida poolPtra\<rbrace> getSlotCap ctSlot \<lbrace>?Q497 pdCapSlot asida poolPtra\<rbrace>
 5. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap ctSlot)
 6. \<And>pdCapSlot asida poolPtra s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (isPDCap \<circ> cteCap) ctSlot and asid_pool_at' poolPtr and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q491 pdCapSlot asida poolPtra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ?Q497 pdCapSlot asida poolPtra rv s \<longrightarrow> s' \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (ko_at' (asidpool.ASIDPool rva) poolPtr and (cte_wp_at' ((=) rv \<circ> cteCap) ctSlot and K (isPDCap rv \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. True \<and> True \<and> asid_pool_at' (ptr_val poolPtra) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot) s))) s \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ko_at' (asidpool.ASIDPool rva) poolPtr s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c pdCapSlot \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capPDMappedASID_CL := UCAST(32 \<rightarrow> 32) asida && mask 17\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c pdCapSlot \<longrightarrow> t \<Turnstile>\<^sub>c cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>ta. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capPDIsMapped_CL := SCAST(32 signed \<rightarrow> 32) 1 && mask 1\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>y. dc y (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>)) \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))) \<longrightarrow> casid_pool_relation (asidpool.ASIDPool (rva(asida && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap rv)))) (asid_pool_C.asid_pool_C (Arrays.update (h_val (hrs_mem (t_hrs_' (globals ta))) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr (capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))))))) \<and> 0xA <s 0x20 \<and> sint 0 \<le> sint 0xA \<and> asida && 2 ^ local.asid_low_bits - 1 < 0x400))))}}}} proof (prove)
goal (6 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q497 (cte_Ptr ctSlot) asid (ap_Ptr poolPtr) oldcap\<rbrace> getObject poolPtr \<lbrace>(\<lambda>pool s. ko_at' (asidpool.ASIDPool pool) poolPtr s \<and> cte_wp_at' (\<lambda>a. oldcap = cteCap a) ctSlot s \<and> isPDCap oldcap \<and> asid \<le> mask local.asid_bits \<and> asid_pool_at' poolPtr s \<and> cte_wp_at' (\<lambda>_. True) ctSlot s) \<circ> (\<lambda>y. SOME x. asidpool.ASIDPool x = y)\<rbrace>
 2. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 3. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 pdCapSlot asida poolPtra\<rbrace> getSlotCap ctSlot \<lbrace>?Q497 pdCapSlot asida poolPtra\<rbrace>
 5. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap ctSlot)
 6. \<And>pdCapSlot asida poolPtra s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (isPDCap \<circ> cteCap) ctSlot and asid_pool_at' poolPtr and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q491 pdCapSlot asida poolPtra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ?Q497 pdCapSlot asida poolPtra rv s \<longrightarrow> s' \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (ko_at' (asidpool.ASIDPool rva) poolPtr and (cte_wp_at' ((=) rv \<circ> cteCap) ctSlot and K (isPDCap rv \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. True \<and> True \<and> asid_pool_at' (ptr_val poolPtra) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot) s))) s \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ko_at' (asidpool.ASIDPool rva) poolPtr s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c pdCapSlot \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capPDMappedASID_CL := UCAST(32 \<rightarrow> 32) asida && mask 17\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c pdCapSlot \<longrightarrow> t \<Turnstile>\<^sub>c cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>ta. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capPDIsMapped_CL := SCAST(32 signed \<rightarrow> 32) 1 && mask 1\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>y. dc y (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>)) \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))) \<longrightarrow> casid_pool_relation (asidpool.ASIDPool (rva(asida && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap rv)))) (asid_pool_C.asid_pool_C (Arrays.update (h_val (hrs_mem (t_hrs_' (globals ta))) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr (capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))))))) \<and> 0xA <s 0x20 \<and> sint 0 \<le> sint 0xA \<and> asida && 2 ^ local.asid_low_bits - 1 < 0x400))))}}}} proof (prove)
goal (5 subgoals):
 1. \<And>pdCapSlot asida poolPtra oldcap. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (liftM (inv asidpool.ASIDPool) (getObject poolPtr))
 2. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 pdCapSlot asida poolPtra\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>a b. \<forall>ko. ko_at' ko poolPtr b \<longrightarrow> ((\<lambda>pool s. ko_at' (asidpool.ASIDPool pool) poolPtr s \<and> cte_wp_at' (\<lambda>b. a = cteCap b) ctSlot s \<and> isPDCap a \<and> asida \<le> mask local.asid_bits \<and> asid_pool_at' poolPtr s \<and> cte_wp_at' (\<lambda>_. True) ctSlot s) \<circ> (\<lambda>y. SOME x. asidpool.ASIDPool x = y)) ko b\<rbrace>
 4. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap ctSlot)
 5. \<And>pdCapSlot asida poolPtra s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (isPDCap \<circ> cteCap) ctSlot and asid_pool_at' poolPtr and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q491 pdCapSlot asida poolPtra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (\<forall>ko. ko_at' ko poolPtr s \<longrightarrow> ((\<lambda>pool s. ko_at' (asidpool.ASIDPool pool) poolPtr s \<and> cte_wp_at' (\<lambda>a. rv = cteCap a) ctSlot s \<and> isPDCap rv \<and> asida \<le> mask local.asid_bits \<and> asid_pool_at' poolPtr s \<and> cte_wp_at' (\<lambda>_. True) ctSlot s) \<circ> (\<lambda>y. SOME x. asidpool.ASIDPool x = y)) ko s) \<longrightarrow> s' \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (ko_at' (asidpool.ASIDPool rva) poolPtr and (cte_wp_at' ((=) rv \<circ> cteCap) ctSlot and K (isPDCap rv \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. True \<and> True \<and> asid_pool_at' (ptr_val poolPtra) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot) s))) s \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ko_at' (asidpool.ASIDPool rva) poolPtr s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c pdCapSlot \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capPDMappedASID_CL := UCAST(32 \<rightarrow> 32) asida && mask 17\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c pdCapSlot \<longrightarrow> t \<Turnstile>\<^sub>c cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>ta. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capPDIsMapped_CL := SCAST(32 signed \<rightarrow> 32) 1 && mask 1\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>y. dc y (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>)) \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))) \<longrightarrow> casid_pool_relation (asidpool.ASIDPool (rva(asida && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap rv)))) (asid_pool_C.asid_pool_C (Arrays.update (h_val (hrs_mem (t_hrs_' (globals ta))) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr (capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))))))) \<and> 0xA <s 0x20 \<and> sint 0 \<le> sint 0xA \<and> asida && 2 ^ local.asid_low_bits - 1 < 0x400))))}}}} proof (prove)
goal (5 subgoals):
 1. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (getObject poolPtr)
 2. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 pdCapSlot asida poolPtra\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>a b. \<forall>ko. ko_at' ko poolPtr b \<longrightarrow> ((\<lambda>pool s. ko_at' (asidpool.ASIDPool pool) poolPtr s \<and> cte_wp_at' (\<lambda>b. a = cteCap b) ctSlot s \<and> isPDCap a \<and> asida \<le> mask local.asid_bits \<and> asid_pool_at' poolPtr s \<and> cte_wp_at' (\<lambda>_. True) ctSlot s) \<circ> (\<lambda>y. SOME x. asidpool.ASIDPool x = y)) ko b\<rbrace>
 4. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap ctSlot)
 5. \<And>pdCapSlot asida poolPtra s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (isPDCap \<circ> cteCap) ctSlot and asid_pool_at' poolPtr and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q491 pdCapSlot asida poolPtra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (\<forall>ko. ko_at' ko poolPtr s \<longrightarrow> ((\<lambda>pool s. ko_at' (asidpool.ASIDPool pool) poolPtr s \<and> cte_wp_at' (\<lambda>a. rv = cteCap a) ctSlot s \<and> isPDCap rv \<and> asida \<le> mask local.asid_bits \<and> asid_pool_at' poolPtr s \<and> cte_wp_at' (\<lambda>_. True) ctSlot s) \<circ> (\<lambda>y. SOME x. asidpool.ASIDPool x = y)) ko s) \<longrightarrow> s' \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (ko_at' (asidpool.ASIDPool rva) poolPtr and (cte_wp_at' ((=) rv \<circ> cteCap) ctSlot and K (isPDCap rv \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. True \<and> True \<and> asid_pool_at' (ptr_val poolPtra) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot) s))) s \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ko_at' (asidpool.ASIDPool rva) poolPtr s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c pdCapSlot \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capPDMappedASID_CL := UCAST(32 \<rightarrow> 32) asida && mask 17\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c pdCapSlot \<longrightarrow> t \<Turnstile>\<^sub>c cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>ta. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capPDIsMapped_CL := SCAST(32 signed \<rightarrow> 32) 1 && mask 1\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>y. dc y (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>)) \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))) \<longrightarrow> casid_pool_relation (asidpool.ASIDPool (rva(asida && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap rv)))) (asid_pool_C.asid_pool_C (Arrays.update (h_val (hrs_mem (t_hrs_' (globals ta))) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr (capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))))))) \<and> 0xA <s 0x20 \<and> sint 0 \<le> sint 0xA \<and> asida && 2 ^ local.asid_low_bits - 1 < 0x400))))}}}} proof (prove)
goal (5 subgoals):
 1. \<And>pdCapSlot asida poolPtra b c d. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (loadObject poolPtr b c d)
 2. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 pdCapSlot asida poolPtra\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>a b. \<forall>ko. ko_at' ko poolPtr b \<longrightarrow> ((\<lambda>pool s. ko_at' (asidpool.ASIDPool pool) poolPtr s \<and> cte_wp_at' (\<lambda>b. a = cteCap b) ctSlot s \<and> isPDCap a \<and> asida \<le> mask local.asid_bits \<and> asid_pool_at' poolPtr s \<and> cte_wp_at' (\<lambda>_. True) ctSlot s) \<circ> (\<lambda>y. SOME x. asidpool.ASIDPool x = y)) ko b\<rbrace>
 4. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap ctSlot)
 5. \<And>pdCapSlot asida poolPtra s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (isPDCap \<circ> cteCap) ctSlot and asid_pool_at' poolPtr and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q491 pdCapSlot asida poolPtra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (\<forall>ko. ko_at' ko poolPtr s \<longrightarrow> ((\<lambda>pool s. ko_at' (asidpool.ASIDPool pool) poolPtr s \<and> cte_wp_at' (\<lambda>a. rv = cteCap a) ctSlot s \<and> isPDCap rv \<and> asida \<le> mask local.asid_bits \<and> asid_pool_at' poolPtr s \<and> cte_wp_at' (\<lambda>_. True) ctSlot s) \<circ> (\<lambda>y. SOME x. asidpool.ASIDPool x = y)) ko s) \<longrightarrow> s' \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (ko_at' (asidpool.ASIDPool rva) poolPtr and (cte_wp_at' ((=) rv \<circ> cteCap) ctSlot and K (isPDCap rv \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. True \<and> True \<and> asid_pool_at' (ptr_val poolPtra) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot) s))) s \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ko_at' (asidpool.ASIDPool rva) poolPtr s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c pdCapSlot \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capPDMappedASID_CL := UCAST(32 \<rightarrow> 32) asida && mask 17\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c pdCapSlot \<longrightarrow> t \<Turnstile>\<^sub>c cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>ta. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capPDIsMapped_CL := SCAST(32 signed \<rightarrow> 32) 1 && mask 1\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>y. dc y (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>)) \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))) \<longrightarrow> casid_pool_relation (asidpool.ASIDPool (rva(asida && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap rv)))) (asid_pool_C.asid_pool_C (Arrays.update (h_val (hrs_mem (t_hrs_' (globals ta))) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr (capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))))))) \<and> 0xA <s 0x20 \<and> sint 0 \<le> sint 0xA \<and> asida && 2 ^ local.asid_low_bits - 1 < 0x400))))}}}} proof (prove)
goal (4 subgoals):
 1. \<And>pdCapSlot asida poolPtra s. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 pdCapSlot asida poolPtra\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>a b. \<forall>ko. ko_at' ko poolPtr b \<longrightarrow> ((\<lambda>pool s. ko_at' (asidpool.ASIDPool pool) poolPtr s \<and> cte_wp_at' (\<lambda>b. a = cteCap b) ctSlot s \<and> isPDCap a \<and> asida \<le> mask local.asid_bits \<and> asid_pool_at' poolPtr s \<and> cte_wp_at' (\<lambda>_. True) ctSlot s) \<circ> (\<lambda>y. SOME x. asidpool.ASIDPool x = y)) ko b\<rbrace>
 3. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap ctSlot)
 4. \<And>pdCapSlot asida poolPtra s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (isPDCap \<circ> cteCap) ctSlot and asid_pool_at' poolPtr and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q491 pdCapSlot asida poolPtra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (\<forall>ko. ko_at' ko poolPtr s \<longrightarrow> ((\<lambda>pool s. ko_at' (asidpool.ASIDPool pool) poolPtr s \<and> cte_wp_at' (\<lambda>a. rv = cteCap a) ctSlot s \<and> isPDCap rv \<and> asida \<le> mask local.asid_bits \<and> asid_pool_at' poolPtr s \<and> cte_wp_at' (\<lambda>_. True) ctSlot s) \<circ> (\<lambda>y. SOME x. asidpool.ASIDPool x = y)) ko s) \<longrightarrow> s' \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (ko_at' (asidpool.ASIDPool rva) poolPtr and (cte_wp_at' ((=) rv \<circ> cteCap) ctSlot and K (isPDCap rv \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. True \<and> True \<and> asid_pool_at' (ptr_val poolPtra) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot) s))) s \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ko_at' (asidpool.ASIDPool rva) poolPtr s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c pdCapSlot \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capPDMappedASID_CL := UCAST(32 \<rightarrow> 32) asida && mask 17\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c pdCapSlot \<longrightarrow> t \<Turnstile>\<^sub>c cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>ta. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capPDIsMapped_CL := SCAST(32 signed \<rightarrow> 32) 1 && mask 1\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>y. dc y (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>)) \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))) \<longrightarrow> casid_pool_relation (asidpool.ASIDPool (rva(asida && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap rv)))) (asid_pool_C.asid_pool_C (Arrays.update (h_val (hrs_mem (t_hrs_' (globals ta))) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr (capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))))))) \<and> 0xA <s 0x20 \<and> sint 0 \<le> sint 0xA \<and> asida && 2 ^ local.asid_low_bits - 1 < 0x400))))}}}} proof (prove)
goal (3 subgoals):
 1. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> \<lbrace>?Q491 pdCapSlot asida poolPtra\<rbrace> getSlotCap ctSlot \<lbrace>\<lambda>a b. \<forall>ko. ko_at' ko poolPtr b \<longrightarrow> ((\<lambda>pool s. ko_at' (asidpool.ASIDPool pool) poolPtr s \<and> cte_wp_at' (\<lambda>b. a = cteCap b) ctSlot s \<and> isPDCap a \<and> asida \<le> mask local.asid_bits \<and> asid_pool_at' poolPtr s \<and> cte_wp_at' (\<lambda>_. True) ctSlot s) \<circ> (\<lambda>y. SOME x. asidpool.ASIDPool x = y)) ko b\<rbrace>
 2. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap ctSlot)
 3. \<And>pdCapSlot asida poolPtra s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (isPDCap \<circ> cteCap) ctSlot and asid_pool_at' poolPtr and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q491 pdCapSlot asida poolPtra s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (\<forall>ko. ko_at' ko poolPtr s \<longrightarrow> ((\<lambda>pool s. ko_at' (asidpool.ASIDPool pool) poolPtr s \<and> cte_wp_at' (\<lambda>a. rv = cteCap a) ctSlot s \<and> isPDCap rv \<and> asida \<le> mask local.asid_bits \<and> asid_pool_at' poolPtr s \<and> cte_wp_at' (\<lambda>_. True) ctSlot s) \<circ> (\<lambda>y. SOME x. asidpool.ASIDPool x = y)) ko s) \<longrightarrow> s' \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (ko_at' (asidpool.ASIDPool rva) poolPtr and (cte_wp_at' ((=) rv \<circ> cteCap) ctSlot and K (isPDCap rv \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. True \<and> True \<and> asid_pool_at' (ptr_val poolPtra) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot) s))) s \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ko_at' (asidpool.ASIDPool rva) poolPtr s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c pdCapSlot \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capPDMappedASID_CL := UCAST(32 \<rightarrow> 32) asida && mask 17\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c pdCapSlot \<longrightarrow> t \<Turnstile>\<^sub>c cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>ta. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capPDIsMapped_CL := SCAST(32 signed \<rightarrow> 32) 1 && mask 1\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>y. dc y (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>)) \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))) \<longrightarrow> casid_pool_relation (asidpool.ASIDPool (rva(asida && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap rv)))) (asid_pool_C.asid_pool_C (Arrays.update (h_val (hrs_mem (t_hrs_' (globals ta))) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr (capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))))))) \<and> 0xA <s 0x20 \<and> sint 0 \<le> sint 0xA \<and> asida && 2 ^ local.asid_low_bits - 1 < 0x400))))}}}} proof (prove)
goal (2 subgoals):
 1. \<And>pdCapSlot asida poolPtra. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap ctSlot)
 2. \<And>pdCapSlot asida poolPtra s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (isPDCap \<circ> cteCap) ctSlot and asid_pool_at' poolPtr and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot s \<longrightarrow> (\<forall>ko. ko_at' ko poolPtr s \<longrightarrow> ((\<lambda>pool s. ko_at' (asidpool.ASIDPool pool) poolPtr s \<and> cte_wp_at' (\<lambda>a. cap = cteCap a) ctSlot s \<and> isPDCap cap \<and> asida \<le> mask local.asid_bits \<and> asid_pool_at' poolPtr s \<and> cte_wp_at' (\<lambda>_. True) ctSlot s) \<circ> (\<lambda>y. SOME x. asidpool.ASIDPool x = y)) ko s)) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (\<forall>ko. ko_at' ko poolPtr s \<longrightarrow> ((\<lambda>pool s. ko_at' (asidpool.ASIDPool pool) poolPtr s \<and> cte_wp_at' (\<lambda>a. rv = cteCap a) ctSlot s \<and> isPDCap rv \<and> asida \<le> mask local.asid_bits \<and> asid_pool_at' poolPtr s \<and> cte_wp_at' (\<lambda>_. True) ctSlot s) \<circ> (\<lambda>y. SOME x. asidpool.ASIDPool x = y)) ko s) \<longrightarrow> s' \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (ko_at' (asidpool.ASIDPool rva) poolPtr and (cte_wp_at' ((=) rv \<circ> cteCap) ctSlot and K (isPDCap rv \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. True \<and> True \<and> asid_pool_at' (ptr_val poolPtra) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot) s))) s \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ko_at' (asidpool.ASIDPool rva) poolPtr s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c pdCapSlot \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capPDMappedASID_CL := UCAST(32 \<rightarrow> 32) asida && mask 17\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c pdCapSlot \<longrightarrow> t \<Turnstile>\<^sub>c cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>ta. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capPDIsMapped_CL := SCAST(32 signed \<rightarrow> 32) 1 && mask 1\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>y. dc y (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>)) \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))) \<longrightarrow> casid_pool_relation (asidpool.ASIDPool (rva(asida && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap rv)))) (asid_pool_C.asid_pool_C (Arrays.update (h_val (hrs_mem (t_hrs_' (globals ta))) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr (capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))))))) \<and> 0xA <s 0x20 \<and> sint 0 \<le> sint 0xA \<and> asida && 2 ^ local.asid_low_bits - 1 < 0x400))))}}}} proof (prove)
goal (1 subgoal):
 1. \<And>pdCapSlot asida poolPtra s s'. \<lbrakk>pdCapSlot = cte_Ptr ctSlot; asida = asid; poolPtra = ap_Ptr poolPtr; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (isPDCap \<circ> cteCap) ctSlot and asid_pool_at' poolPtr and (\<lambda>y. asid \<le> mask local.asid_bits)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot s \<longrightarrow> (\<forall>ko. ko_at' ko poolPtr s \<longrightarrow> ((\<lambda>pool s. ko_at' (asidpool.ASIDPool pool) poolPtr s \<and> cte_wp_at' (\<lambda>a. cap = cteCap a) ctSlot s \<and> isPDCap cap \<and> asida \<le> mask local.asid_bits \<and> asid_pool_at' poolPtr s \<and> cte_wp_at' (\<lambda>_. True) ctSlot s) \<circ> (\<lambda>y. SOME x. asidpool.ASIDPool x = y)) ko s)) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (\<forall>ko. ko_at' ko poolPtr s \<longrightarrow> ((\<lambda>pool s. ko_at' (asidpool.ASIDPool pool) poolPtr s \<and> cte_wp_at' (\<lambda>a. rv = cteCap a) ctSlot s \<and> isPDCap rv \<and> asida \<le> mask local.asid_bits \<and> asid_pool_at' poolPtr s \<and> cte_wp_at' (\<lambda>_. True) ctSlot s) \<circ> (\<lambda>y. SOME x. asidpool.ASIDPool x = y)) ko s) \<longrightarrow> s' \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (ko_at' (asidpool.ASIDPool rva) poolPtr and (cte_wp_at' ((=) rv \<circ> cteCap) ctSlot and K (isPDCap rv \<and> asida \<le> mask local.asid_bits) and (\<lambda>s. True \<and> True \<and> asid_pool_at' (ptr_val poolPtra) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val pdCapSlot) s))) s \<longrightarrow> s' \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> ko_at' (asidpool.ASIDPool rva) poolPtr s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c pdCapSlot \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capPDMappedASID_CL := UCAST(32 \<rightarrow> 32) asida && mask 17\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c pdCapSlot \<longrightarrow> t \<Turnstile>\<^sub>c cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>ta. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capPDIsMapped_CL := SCAST(32 signed \<rightarrow> 32) 1 && mask 1\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift t (cparent (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals t))) \<longrightarrow> (\<forall>y. dc y (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>)) \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))) \<longrightarrow> casid_pool_relation (asidpool.ASIDPool (rva(asida && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap rv)))) (asid_pool_C.asid_pool_C (Arrays.update (h_val (hrs_mem (t_hrs_' (globals ta))) (PTR(pde_C ptr[1024]) &(poolPtra\<rightarrow>[''array_C'']))) (unat (asida && 2 ^ local.asid_low_bits - 1)) (pde_Ptr (capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(pdCapSlot\<rightarrow>[''cap_C''])))))))) \<and> 0xA <s 0x20 \<and> sint 0 \<le> sint 0xA \<and> asida && 2 ^ local.asid_low_bits - 1 < 0x400))))}}}} proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid_pool_at' poolPtr s; asid \<le> mask local.asid_bits; ctes_of s ctSlot = Some cte; isPDCap (cteCap cte)\<rbrakk> \<Longrightarrow> (\<forall>ko. ko_at' ko poolPtr s \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr s) \<and> (\<forall>rv. (\<exists>s. (s, s') \<in> rf_sr \<and> (\<forall>ko. ko_at' ko poolPtr s \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr s \<and> (\<exists>cte. ctes_of s ctSlot = Some cte \<and> rv = cteCap cte) \<and> isPDCap rv \<and> asid_pool_at' poolPtr s \<and> (\<exists>cte. ctes_of s ctSlot = Some cte))) \<longrightarrow> (\<forall>rva. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' (asidpool.ASIDPool rva) poolPtr s \<and> (\<exists>cte. ctes_of s ctSlot = Some cte \<and> rv = cteCap cte) \<and> isPDCap rv \<and> asid_pool_at' poolPtr s \<and> (\<exists>cte. ctes_of s ctSlot = Some cte)) \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' (asidpool.ASIDPool rva) poolPtr s) \<longrightarrow> s' \<Turnstile>\<^sub>c cte_Ptr ctSlot \<longrightarrow> cap_get_tag (cte_C.cap_C (the (cslift s' (cte_Ptr ctSlot)))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift s' (cte_Ptr ctSlot))))\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s' (cte_Ptr ctSlot))))) (t_hrs_' (globals s'))) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr ctSlot \<longrightarrow> cap_get_tag (cte_C.cap_C (the (cslift t (cte_Ptr ctSlot)))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>ta. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift t (cte_Ptr ctSlot))))\<lparr>capPDIsMapped_CL := 1\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift t (cte_Ptr ctSlot))))) (t_hrs_' (globals t))) \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> ((\<exists>t. ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']))))) \<longrightarrow> casid_pool_relation (asidpool.ASIDPool (rva(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap rv)))) (asid_pool_C.asid_pool_C (Arrays.update (h_val (hrs_mem (t_hrs_' (globals ta))) (PTR(pde_C ptr[1024]) &(ap_Ptr poolPtr\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) (pde_Ptr (capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C''])))))))) \<and> asid && 2 ^ local.asid_low_bits - 1 < 0x400))))) proof (prove)
goal (2 subgoals):
 1. \<And>s s' cte. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid_pool_at' poolPtr s; asid \<le> mask local.asid_bits; ctes_of s ctSlot = Some cte; isPDCap (cteCap cte)\<rbrakk> \<Longrightarrow> \<forall>ko. ko_at' ko poolPtr s \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr s
 2. \<And>s s' cte. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid_pool_at' poolPtr s; asid \<le> mask local.asid_bits; ctes_of s ctSlot = Some cte; isPDCap (cteCap cte)\<rbrakk> \<Longrightarrow> \<forall>rv. (\<exists>s. (s, s') \<in> rf_sr \<and> (\<forall>ko. ko_at' ko poolPtr s \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr s \<and> (\<exists>cte. ctes_of s ctSlot = Some cte \<and> rv = cteCap cte) \<and> isPDCap rv \<and> asid_pool_at' poolPtr s \<and> (\<exists>cte. ctes_of s ctSlot = Some cte))) \<longrightarrow> (\<forall>rva. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' (asidpool.ASIDPool rva) poolPtr s \<and> (\<exists>cte. ctes_of s ctSlot = Some cte \<and> rv = cteCap cte) \<and> isPDCap rv \<and> asid_pool_at' poolPtr s \<and> (\<exists>cte. ctes_of s ctSlot = Some cte)) \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' (asidpool.ASIDPool rva) poolPtr s) \<longrightarrow> s' \<Turnstile>\<^sub>c cte_Ptr ctSlot \<longrightarrow> cap_get_tag (cte_C.cap_C (the (cslift s' (cte_Ptr ctSlot)))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift s' (cte_Ptr ctSlot))))\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s' (cte_Ptr ctSlot))))) (t_hrs_' (globals s'))) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr ctSlot \<longrightarrow> cap_get_tag (cte_C.cap_C (the (cslift t (cte_Ptr ctSlot)))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>ta. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift t (cte_Ptr ctSlot))))\<lparr>capPDIsMapped_CL := 1\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift t (cte_Ptr ctSlot))))) (t_hrs_' (globals t))) \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> ((\<exists>t. ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']))))) \<longrightarrow> casid_pool_relation (asidpool.ASIDPool (rva(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap rv)))) (asid_pool_C.asid_pool_C (Arrays.update (h_val (hrs_mem (t_hrs_' (globals ta))) (PTR(pde_C ptr[1024]) &(ap_Ptr poolPtr\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) (pde_Ptr (capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C''])))))))) \<and> asid && 2 ^ local.asid_low_bits - 1 < 0x400)))) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid_pool_at' poolPtr s; asid \<le> mask local.asid_bits; ctes_of s ctSlot = Some cte; isPDCap (cteCap cte)\<rbrakk> \<Longrightarrow> \<forall>rv. (\<exists>s. (s, s') \<in> rf_sr \<and> (\<forall>ko. ko_at' ko poolPtr s \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr s \<and> (\<exists>cte. ctes_of s ctSlot = Some cte \<and> rv = cteCap cte) \<and> isPDCap rv \<and> asid_pool_at' poolPtr s \<and> (\<exists>cte. ctes_of s ctSlot = Some cte))) \<longrightarrow> (\<forall>rva. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' (asidpool.ASIDPool rva) poolPtr s \<and> (\<exists>cte. ctes_of s ctSlot = Some cte \<and> rv = cteCap cte) \<and> isPDCap rv \<and> asid_pool_at' poolPtr s \<and> (\<exists>cte. ctes_of s ctSlot = Some cte)) \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' (asidpool.ASIDPool rva) poolPtr s) \<longrightarrow> s' \<Turnstile>\<^sub>c cte_Ptr ctSlot \<longrightarrow> cap_get_tag (cte_C.cap_C (the (cslift s' (cte_Ptr ctSlot)))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift s' (cte_Ptr ctSlot))))\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s' (cte_Ptr ctSlot))))) (t_hrs_' (globals s'))) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr ctSlot \<longrightarrow> cap_get_tag (cte_C.cap_C (the (cslift t (cte_Ptr ctSlot)))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>ta. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift t (cte_Ptr ctSlot))))\<lparr>capPDIsMapped_CL := 1\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift t (cte_Ptr ctSlot))))) (t_hrs_' (globals t))) \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> ((\<exists>t. ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']))))) \<longrightarrow> casid_pool_relation (asidpool.ASIDPool (rva(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap rv)))) (asid_pool_C.asid_pool_C (Arrays.update (h_val (hrs_mem (t_hrs_' (globals ta))) (PTR(pde_C ptr[1024]) &(ap_Ptr poolPtr\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) (pde_Ptr (capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C''])))))))) \<and> asid && 2 ^ local.asid_low_bits - 1 < 0x400)))) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte y'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid_pool_at' poolPtr s; asid \<le> mask local.asid_bits; ctes_of s ctSlot = Some cte; isPDCap (cteCap cte); ctes_of s ctSlot = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr ctSlot) = Some y'\<rbrakk> \<Longrightarrow> \<forall>rv. (\<exists>s. (s, s') \<in> rf_sr \<and> (\<forall>ko. ko_at' ko poolPtr s \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr s \<and> (\<exists>cte. ctes_of s ctSlot = Some cte \<and> rv = cteCap cte) \<and> isPDCap rv \<and> asid_pool_at' poolPtr s \<and> (\<exists>cte. ctes_of s ctSlot = Some cte))) \<longrightarrow> (\<forall>rva. (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' (asidpool.ASIDPool rva) poolPtr s \<and> (\<exists>cte. ctes_of s ctSlot = Some cte \<and> rv = cteCap cte) \<and> isPDCap rv \<and> asid_pool_at' poolPtr s \<and> (\<exists>cte. ctes_of s ctSlot = Some cte)) \<longrightarrow> (\<exists>s. (s, s') \<in> rf_sr \<and> ko_at' (asidpool.ASIDPool rva) poolPtr s) \<longrightarrow> s' \<Turnstile>\<^sub>c cte_Ptr ctSlot \<longrightarrow> cap_get_tag (cte_C.cap_C (the (cslift s' (cte_Ptr ctSlot)))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>t. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift s' (cte_Ptr ctSlot))))\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s' (cte_Ptr ctSlot))))) (t_hrs_' (globals s'))) \<longrightarrow> t \<Turnstile>\<^sub>c cte_Ptr ctSlot \<longrightarrow> cap_get_tag (cte_C.cap_C (the (cslift t (cte_Ptr ctSlot)))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> (\<forall>ta. (\<exists>cap. cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C (the (cslift t (cte_Ptr ctSlot))))\<lparr>capPDIsMapped_CL := 1\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift t (cte_Ptr ctSlot))))) (t_hrs_' (globals t))) \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<and> ((\<exists>t. ret__unsigned_' t = capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']))))) \<longrightarrow> casid_pool_relation (asidpool.ASIDPool (rva(asid && mask local.asid_low_bits \<mapsto> capPDBasePtr (capCap rv)))) (asid_pool_C.asid_pool_C (Arrays.update (h_val (hrs_mem (t_hrs_' (globals ta))) (PTR(pde_C ptr[1024]) &(ap_Ptr poolPtr\<rightarrow>[''array_C'']))) (unat (asid && 2 ^ local.asid_low_bits - 1)) (pde_Ptr (capPDBasePtr_CL (cap_page_directory_cap_lift (h_val (hrs_mem (t_hrs_' (globals ta))) (cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C''])))))))) \<and> asid && 2 ^ local.asid_low_bits - 1 < 0x400)))) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte y' p asida sa rva sb ctea pa asidaa sc t cap ta capa tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid_pool_at' poolPtr s; asid \<le> mask local.asid_bits; ctes_of s ctSlot = Some cte; cslift s' (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida)) (cte_C.cap_C y'); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); (sa, s') \<in> rf_sr; \<forall>ko. ko_at' ko poolPtr sa \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte \<and> cteCap ctea = cteCap cte) \<and> (\<exists>p asid. cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asid)) \<and> asid_pool_at' poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte); (sb, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sb; capability.ArchObjectCap (arch_capability.PageDirectoryCap pa asidaa) = cteCap ctea; asid_pool_at' poolPtr sb; ctes_of sb ctSlot = Some ctea; (sc, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sc; cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && mask 17\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s')); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && mask 17, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) y')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s'))); ret__unsigned_' tb = capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y'))\<rbrakk> \<Longrightarrow> casid_pool_relation (asidpool.ASIDPool (rva(asid && mask 10 \<mapsto> capPDBasePtr (capCap (cteCap ctea))))) (asid_pool_C.asid_pool_C (Arrays.update (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) y')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s'))))) (PTR(pde_C ptr[1024]) &(ap_Ptr poolPtr\<rightarrow>[''array_C'']))) (unat (asid && 0x3FF)) (pde_Ptr (capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y')))))) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte y' p asida sa rva sb ctea pa asidaa sc t cap ta capa tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid_pool_at' poolPtr s; asid < 2 ^ local.asid_bits; ctes_of s ctSlot = Some cte; cslift s' (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida)) (cte_C.cap_C y'); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); (sa, s') \<in> rf_sr; \<forall>ko. ko_at' ko poolPtr sa \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte \<and> cteCap ctea = cteCap cte) \<and> (\<exists>p asid. cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asid)) \<and> asid_pool_at' poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte); (sb, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sb; capability.ArchObjectCap (arch_capability.PageDirectoryCap pa asidaa) = cteCap ctea; asid_pool_at' poolPtr sb; ctes_of sb ctSlot = Some ctea; (sc, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sc; cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s')); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) y')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s'))); ret__unsigned_' tb = capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y'))\<rbrakk> \<Longrightarrow> array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_low_bits - 1) (rva(asid && 0x3FF \<mapsto> capPDBasePtr (capCap (cteCap ctea)))) (Arrays.update (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) y')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s'))))) (PTR(pde_C ptr[1024]) &(ap_Ptr poolPtr\<rightarrow>[''array_C'']))) (unat (asid && 0x3FF)) (pde_Ptr (capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y'))))) proof (prove)
goal (4 subgoals):
 1. \<And>s s' cte y' p asida sa rva sb ctea pa asidaa sc t cap ta capa tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid_pool_at' poolPtr s; asid < 2 ^ local.asid_bits; ctes_of s ctSlot = Some cte; cslift s' (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida)) (cte_C.cap_C y'); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); (sa, s') \<in> rf_sr; \<forall>ko. ko_at' ko poolPtr sa \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte \<and> cteCap ctea = cteCap cte) \<and> (\<exists>p asid. cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asid)) \<and> asid_pool_at' poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte); (sb, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sb; capability.ArchObjectCap (arch_capability.PageDirectoryCap pa asidaa) = cteCap ctea; asid_pool_at' poolPtr sb; ctes_of sb ctSlot = Some ctea; (sc, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sc; cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s')); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) y')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s'))); ret__unsigned_' tb = capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y'))\<rbrakk> \<Longrightarrow> array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_low_bits - 1) rva (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) y')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s'))))) (PTR(pde_C ptr[1024]) &(ap_Ptr poolPtr\<rightarrow>[''array_C''])))
 2. \<And>s s' cte y' p asida sa rva sb ctea pa asidaa sc t cap ta capa tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid_pool_at' poolPtr s; asid < 2 ^ local.asid_bits; ctes_of s ctSlot = Some cte; cslift s' (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida)) (cte_C.cap_C y'); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); (sa, s') \<in> rf_sr; \<forall>ko. ko_at' ko poolPtr sa \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte \<and> cteCap ctea = cteCap cte) \<and> (\<exists>p asid. cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asid)) \<and> asid_pool_at' poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte); (sb, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sb; capability.ArchObjectCap (arch_capability.PageDirectoryCap pa asidaa) = cteCap ctea; asid_pool_at' poolPtr sb; ctes_of sb ctSlot = Some ctea; (sc, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sc; cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s')); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) y')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s'))); ret__unsigned_' tb = capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y'))\<rbrakk> \<Longrightarrow> unat (asid && 0x3FF) = unat (asid && 0x3FF)
 3. \<And>s s' cte y' p asida sa rva sb ctea pa asidaa sc t cap ta capa tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid_pool_at' poolPtr s; asid < 2 ^ local.asid_bits; ctes_of s ctSlot = Some cte; cslift s' (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida)) (cte_C.cap_C y'); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); (sa, s') \<in> rf_sr; \<forall>ko. ko_at' ko poolPtr sa \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte \<and> cteCap ctea = cteCap cte) \<and> (\<exists>p asid. cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asid)) \<and> asid_pool_at' poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte); (sb, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sb; capability.ArchObjectCap (arch_capability.PageDirectoryCap pa asidaa) = cteCap ctea; asid_pool_at' poolPtr sb; ctes_of sb ctSlot = Some ctea; (sc, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sc; cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s')); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) y')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s'))); ret__unsigned_' tb = capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y'))\<rbrakk> \<Longrightarrow> ((=) \<circ> option_to_ptr) (Some (capPDBasePtr (capCap (cteCap ctea)))) (pde_Ptr (capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y'))))
 4. \<And>s s' cte y' p asida sa rva sb ctea pa asidaa sc t cap ta capa tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid_pool_at' poolPtr s; asid < 2 ^ local.asid_bits; ctes_of s ctSlot = Some cte; cslift s' (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida)) (cte_C.cap_C y'); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); (sa, s') \<in> rf_sr; \<forall>ko. ko_at' ko poolPtr sa \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte \<and> cteCap ctea = cteCap cte) \<and> (\<exists>p asid. cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asid)) \<and> asid_pool_at' poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte); (sb, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sb; capability.ArchObjectCap (arch_capability.PageDirectoryCap pa asidaa) = cteCap ctea; asid_pool_at' poolPtr sb; ctes_of sb ctSlot = Some ctea; (sc, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sc; cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s')); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) y')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s'))); ret__unsigned_' tb = capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y'))\<rbrakk> \<Longrightarrow> unat (2 ^ local.asid_low_bits - 1) < CARD(1024) proof (prove)
goal (4 subgoals):
 1. \<And>s s' cte y' p asida sa rva sb ctea pa asidaa sc t cap ta capa tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid_pool_at' poolPtr s; asid < 2 ^ local.asid_bits; ctes_of s ctSlot = Some cte; cslift s' (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida)) (cte_C.cap_C y'); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); (sa, s') \<in> rf_sr; \<forall>ko. ko_at' ko poolPtr sa \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte \<and> cteCap ctea = cteCap cte) \<and> (\<exists>p asid. cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asid)) \<and> asid_pool_at' poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte); (sb, s') \<in> rf_sr; capability.ArchObjectCap (arch_capability.PageDirectoryCap pa asidaa) = cteCap ctea; asid_pool_at' poolPtr sb; ctes_of sb ctSlot = Some ctea; (sc, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sc; cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s')); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) y')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s'))); ret__unsigned_' tb = capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y')); \<exists>pool'. cslift s' (ap_Ptr poolPtr) = Some pool' \<and> casid_pool_relation (asidpool.ASIDPool rva) pool'\<rbrakk> \<Longrightarrow> array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_low_bits - 1) rva (h_val (hrs_mem (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) y')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s'))))) (PTR(pde_C ptr[1024]) &(ap_Ptr poolPtr\<rightarrow>[''array_C''])))
 2. \<And>s s' cte y' p asida sa rva sb ctea pa asidaa sc t cap ta capa tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid_pool_at' poolPtr s; asid < 2 ^ local.asid_bits; ctes_of s ctSlot = Some cte; cslift s' (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida)) (cte_C.cap_C y'); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); (sa, s') \<in> rf_sr; \<forall>ko. ko_at' ko poolPtr sa \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte \<and> cteCap ctea = cteCap cte) \<and> (\<exists>p asid. cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asid)) \<and> asid_pool_at' poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte); (sb, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sb; capability.ArchObjectCap (arch_capability.PageDirectoryCap pa asidaa) = cteCap ctea; asid_pool_at' poolPtr sb; ctes_of sb ctSlot = Some ctea; (sc, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sc; cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s')); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) y')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s'))); ret__unsigned_' tb = capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y'))\<rbrakk> \<Longrightarrow> unat (asid && 0x3FF) = unat (asid && 0x3FF)
 3. \<And>s s' cte y' p asida sa rva sb ctea pa asidaa sc t cap ta capa tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid_pool_at' poolPtr s; asid < 2 ^ local.asid_bits; ctes_of s ctSlot = Some cte; cslift s' (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida)) (cte_C.cap_C y'); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); (sa, s') \<in> rf_sr; \<forall>ko. ko_at' ko poolPtr sa \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte \<and> cteCap ctea = cteCap cte) \<and> (\<exists>p asid. cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asid)) \<and> asid_pool_at' poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte); (sb, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sb; capability.ArchObjectCap (arch_capability.PageDirectoryCap pa asidaa) = cteCap ctea; asid_pool_at' poolPtr sb; ctes_of sb ctSlot = Some ctea; (sc, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sc; cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s')); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) y')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s'))); ret__unsigned_' tb = capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y'))\<rbrakk> \<Longrightarrow> ((=) \<circ> option_to_ptr) (Some (capPDBasePtr (capCap (cteCap ctea)))) (pde_Ptr (capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y'))))
 4. \<And>s s' cte y' p asida sa rva sb ctea pa asidaa sc t cap ta capa tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid_pool_at' poolPtr s; asid < 2 ^ local.asid_bits; ctes_of s ctSlot = Some cte; cslift s' (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida)) (cte_C.cap_C y'); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); (sa, s') \<in> rf_sr; \<forall>ko. ko_at' ko poolPtr sa \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte \<and> cteCap ctea = cteCap cte) \<and> (\<exists>p asid. cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asid)) \<and> asid_pool_at' poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte); (sb, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sb; capability.ArchObjectCap (arch_capability.PageDirectoryCap pa asidaa) = cteCap ctea; asid_pool_at' poolPtr sb; ctes_of sb ctSlot = Some ctea; (sc, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sc; cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s')); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) y')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s'))); ret__unsigned_' tb = capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y'))\<rbrakk> \<Longrightarrow> unat (2 ^ local.asid_low_bits - 1) < CARD(1024) proof (prove)
goal (4 subgoals):
 1. \<And>s s' cte y' p asida sa rva sb ctea pa asidaa sc t cap ta capa tb pool'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid_pool_at' poolPtr s; asid < 2 ^ local.asid_bits; ctes_of s ctSlot = Some cte; cslift s' (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida)) (cte_C.cap_C y'); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); (sa, s') \<in> rf_sr; \<forall>ko. ko_at' ko poolPtr sa \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte \<and> cteCap ctea = cteCap cte) \<and> (\<exists>p asid. cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asid)) \<and> asid_pool_at' poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte); (sb, s') \<in> rf_sr; capability.ArchObjectCap (arch_capability.PageDirectoryCap pa asidaa) = cteCap ctea; asid_pool_at' poolPtr sb; ctes_of sb ctSlot = Some ctea; (sc, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sc; cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s')); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) y')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s'))); ret__unsigned_' tb = capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y')); cslift s' (ap_Ptr poolPtr) = Some pool'; casid_pool_relation (asidpool.ASIDPool rva) pool'\<rbrakk> \<Longrightarrow> array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_low_bits - 1) rva (array_C pool')
 2. \<And>s s' cte y' p asida sa rva sb ctea pa asidaa sc t cap ta capa tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid_pool_at' poolPtr s; asid < 2 ^ local.asid_bits; ctes_of s ctSlot = Some cte; cslift s' (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida)) (cte_C.cap_C y'); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); (sa, s') \<in> rf_sr; \<forall>ko. ko_at' ko poolPtr sa \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte \<and> cteCap ctea = cteCap cte) \<and> (\<exists>p asid. cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asid)) \<and> asid_pool_at' poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte); (sb, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sb; capability.ArchObjectCap (arch_capability.PageDirectoryCap pa asidaa) = cteCap ctea; asid_pool_at' poolPtr sb; ctes_of sb ctSlot = Some ctea; (sc, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sc; cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s')); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) y')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s'))); ret__unsigned_' tb = capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y'))\<rbrakk> \<Longrightarrow> unat (asid && 0x3FF) = unat (asid && 0x3FF)
 3. \<And>s s' cte y' p asida sa rva sb ctea pa asidaa sc t cap ta capa tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid_pool_at' poolPtr s; asid < 2 ^ local.asid_bits; ctes_of s ctSlot = Some cte; cslift s' (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida)) (cte_C.cap_C y'); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); (sa, s') \<in> rf_sr; \<forall>ko. ko_at' ko poolPtr sa \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte \<and> cteCap ctea = cteCap cte) \<and> (\<exists>p asid. cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asid)) \<and> asid_pool_at' poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte); (sb, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sb; capability.ArchObjectCap (arch_capability.PageDirectoryCap pa asidaa) = cteCap ctea; asid_pool_at' poolPtr sb; ctes_of sb ctSlot = Some ctea; (sc, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sc; cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s')); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) y')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s'))); ret__unsigned_' tb = capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y'))\<rbrakk> \<Longrightarrow> ((=) \<circ> option_to_ptr) (Some (capPDBasePtr (capCap (cteCap ctea)))) (pde_Ptr (capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y'))))
 4. \<And>s s' cte y' p asida sa rva sb ctea pa asidaa sc t cap ta capa tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid_pool_at' poolPtr s; asid < 2 ^ local.asid_bits; ctes_of s ctSlot = Some cte; cslift s' (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida)) (cte_C.cap_C y'); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); (sa, s') \<in> rf_sr; \<forall>ko. ko_at' ko poolPtr sa \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte \<and> cteCap ctea = cteCap cte) \<and> (\<exists>p asid. cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asid)) \<and> asid_pool_at' poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte); (sb, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sb; capability.ArchObjectCap (arch_capability.PageDirectoryCap pa asidaa) = cteCap ctea; asid_pool_at' poolPtr sb; ctes_of sb ctSlot = Some ctea; (sc, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sc; cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s')); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) y')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s'))); ret__unsigned_' tb = capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y'))\<rbrakk> \<Longrightarrow> unat (2 ^ local.asid_low_bits - 1) < CARD(1024) proof (prove)
goal (4 subgoals):
 1. \<And>s s' cte y' p asida sa rva sb ctea pa asidaa sc t cap ta capa tb pool' x. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid_pool_at' poolPtr s; asid < 2 ^ local.asid_bits; ctes_of s ctSlot = Some cte; cslift s' (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida)) (cte_C.cap_C y'); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); (sa, s') \<in> rf_sr; \<forall>ko. ko_at' ko poolPtr sa \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte \<and> cteCap ctea = cteCap cte) \<and> (\<exists>p asid. cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asid)) \<and> asid_pool_at' poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte); (sb, s') \<in> rf_sr; capability.ArchObjectCap (arch_capability.PageDirectoryCap pa asidaa) = cteCap ctea; asid_pool_at' poolPtr sb; ctes_of sb ctSlot = Some ctea; (sc, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sc; cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s')); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) y')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s'))); ret__unsigned_' tb = capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y')); cslift s' (ap_Ptr poolPtr) = Some pool'; casid_pool_relation (asidpool.ASIDPool rva) pool'; pool' = asid_pool_C.asid_pool_C x\<rbrakk> \<Longrightarrow> array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_low_bits - 1) rva (array_C pool')
 2. \<And>s s' cte y' p asida sa rva sb ctea pa asidaa sc t cap ta capa tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid_pool_at' poolPtr s; asid < 2 ^ local.asid_bits; ctes_of s ctSlot = Some cte; cslift s' (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida)) (cte_C.cap_C y'); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); (sa, s') \<in> rf_sr; \<forall>ko. ko_at' ko poolPtr sa \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte \<and> cteCap ctea = cteCap cte) \<and> (\<exists>p asid. cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asid)) \<and> asid_pool_at' poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte); (sb, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sb; capability.ArchObjectCap (arch_capability.PageDirectoryCap pa asidaa) = cteCap ctea; asid_pool_at' poolPtr sb; ctes_of sb ctSlot = Some ctea; (sc, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sc; cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s')); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) y')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s'))); ret__unsigned_' tb = capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y'))\<rbrakk> \<Longrightarrow> unat (asid && 0x3FF) = unat (asid && 0x3FF)
 3. \<And>s s' cte y' p asida sa rva sb ctea pa asidaa sc t cap ta capa tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid_pool_at' poolPtr s; asid < 2 ^ local.asid_bits; ctes_of s ctSlot = Some cte; cslift s' (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida)) (cte_C.cap_C y'); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); (sa, s') \<in> rf_sr; \<forall>ko. ko_at' ko poolPtr sa \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte \<and> cteCap ctea = cteCap cte) \<and> (\<exists>p asid. cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asid)) \<and> asid_pool_at' poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte); (sb, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sb; capability.ArchObjectCap (arch_capability.PageDirectoryCap pa asidaa) = cteCap ctea; asid_pool_at' poolPtr sb; ctes_of sb ctSlot = Some ctea; (sc, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sc; cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s')); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) y')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s'))); ret__unsigned_' tb = capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y'))\<rbrakk> \<Longrightarrow> ((=) \<circ> option_to_ptr) (Some (capPDBasePtr (capCap (cteCap ctea)))) (pde_Ptr (capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y'))))
 4. \<And>s s' cte y' p asida sa rva sb ctea pa asidaa sc t cap ta capa tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid_pool_at' poolPtr s; asid < 2 ^ local.asid_bits; ctes_of s ctSlot = Some cte; cslift s' (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida)) (cte_C.cap_C y'); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); (sa, s') \<in> rf_sr; \<forall>ko. ko_at' ko poolPtr sa \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte \<and> cteCap ctea = cteCap cte) \<and> (\<exists>p asid. cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asid)) \<and> asid_pool_at' poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte); (sb, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sb; capability.ArchObjectCap (arch_capability.PageDirectoryCap pa asidaa) = cteCap ctea; asid_pool_at' poolPtr sb; ctes_of sb ctSlot = Some ctea; (sc, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sc; cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s')); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) y')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s'))); ret__unsigned_' tb = capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y'))\<rbrakk> \<Longrightarrow> unat (2 ^ local.asid_low_bits - 1) < CARD(1024) proof (prove)
goal (3 subgoals):
 1. \<And>s s' cte y' p asida sa rva sb ctea pa asidaa sc t cap ta capa tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid_pool_at' poolPtr s; asid < 2 ^ local.asid_bits; ctes_of s ctSlot = Some cte; cslift s' (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida)) (cte_C.cap_C y'); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); (sa, s') \<in> rf_sr; \<forall>ko. ko_at' ko poolPtr sa \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte \<and> cteCap ctea = cteCap cte) \<and> (\<exists>p asid. cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asid)) \<and> asid_pool_at' poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte); (sb, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sb; capability.ArchObjectCap (arch_capability.PageDirectoryCap pa asidaa) = cteCap ctea; asid_pool_at' poolPtr sb; ctes_of sb ctSlot = Some ctea; (sc, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sc; cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s')); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) y')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s'))); ret__unsigned_' tb = capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y'))\<rbrakk> \<Longrightarrow> unat (asid && 0x3FF) = unat (asid && 0x3FF)
 2. \<And>s s' cte y' p asida sa rva sb ctea pa asidaa sc t cap ta capa tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid_pool_at' poolPtr s; asid < 2 ^ local.asid_bits; ctes_of s ctSlot = Some cte; cslift s' (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida)) (cte_C.cap_C y'); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); (sa, s') \<in> rf_sr; \<forall>ko. ko_at' ko poolPtr sa \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte \<and> cteCap ctea = cteCap cte) \<and> (\<exists>p asid. cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asid)) \<and> asid_pool_at' poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte); (sb, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sb; capability.ArchObjectCap (arch_capability.PageDirectoryCap pa asidaa) = cteCap ctea; asid_pool_at' poolPtr sb; ctes_of sb ctSlot = Some ctea; (sc, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sc; cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s')); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) y')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s'))); ret__unsigned_' tb = capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y'))\<rbrakk> \<Longrightarrow> ((=) \<circ> option_to_ptr) (Some (capPDBasePtr (capCap (cteCap ctea)))) (pde_Ptr (capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y'))))
 3. \<And>s s' cte y' p asida sa rva sb ctea pa asidaa sc t cap ta capa tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid_pool_at' poolPtr s; asid < 2 ^ local.asid_bits; ctes_of s ctSlot = Some cte; cslift s' (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida)) (cte_C.cap_C y'); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); (sa, s') \<in> rf_sr; \<forall>ko. ko_at' ko poolPtr sa \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte \<and> cteCap ctea = cteCap cte) \<and> (\<exists>p asid. cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asid)) \<and> asid_pool_at' poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte); (sb, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sb; capability.ArchObjectCap (arch_capability.PageDirectoryCap pa asidaa) = cteCap ctea; asid_pool_at' poolPtr sb; ctes_of sb ctSlot = Some ctea; (sc, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sc; cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s')); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) y')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s'))); ret__unsigned_' tb = capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y'))\<rbrakk> \<Longrightarrow> unat (2 ^ local.asid_low_bits - 1) < CARD(1024) proof (prove)
goal (2 subgoals):
 1. \<And>s s' cte y' p asida sa rva sb ctea pa asidaa sc t cap ta capa tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid_pool_at' poolPtr s; asid < 2 ^ local.asid_bits; ctes_of s ctSlot = Some cte; cslift s' (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida)) (cte_C.cap_C y'); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); (sa, s') \<in> rf_sr; \<forall>ko. ko_at' ko poolPtr sa \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte \<and> cteCap ctea = cteCap cte) \<and> (\<exists>p asid. cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asid)) \<and> asid_pool_at' poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte); (sb, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sb; capability.ArchObjectCap (arch_capability.PageDirectoryCap pa asidaa) = cteCap ctea; asid_pool_at' poolPtr sb; ctes_of sb ctSlot = Some ctea; (sc, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sc; cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s')); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) y')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s'))); ret__unsigned_' tb = capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y'))\<rbrakk> \<Longrightarrow> ((=) \<circ> option_to_ptr) (Some (capPDBasePtr (capCap (cteCap ctea)))) (pde_Ptr (capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y'))))
 2. \<And>s s' cte y' p asida sa rva sb ctea pa asidaa sc t cap ta capa tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid_pool_at' poolPtr s; asid < 2 ^ local.asid_bits; ctes_of s ctSlot = Some cte; cslift s' (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida)) (cte_C.cap_C y'); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); (sa, s') \<in> rf_sr; \<forall>ko. ko_at' ko poolPtr sa \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte \<and> cteCap ctea = cteCap cte) \<and> (\<exists>p asid. cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asid)) \<and> asid_pool_at' poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte); (sb, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sb; capability.ArchObjectCap (arch_capability.PageDirectoryCap pa asidaa) = cteCap ctea; asid_pool_at' poolPtr sb; ctes_of sb ctSlot = Some ctea; (sc, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sc; cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s')); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) y')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s'))); ret__unsigned_' tb = capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y'))\<rbrakk> \<Longrightarrow> unat (2 ^ local.asid_low_bits - 1) < CARD(1024) proof (prove)
goal (2 subgoals):
 1. \<And>s s' cte y' p asida sa rva sb ctea pa asidaa sc t cap ta capa tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid_pool_at' poolPtr s; asid < 2 ^ local.asid_bits; ctes_of s ctSlot = Some cte; cslift s' (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida)) (cte_C.cap_C y'); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); (sa, s') \<in> rf_sr; \<forall>ko. ko_at' ko poolPtr sa \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte \<and> cteCap ctea = cteCap cte) \<and> (\<exists>p asid. cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asid)) \<and> asid_pool_at' poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte); (sb, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sb; capability.ArchObjectCap (arch_capability.PageDirectoryCap pa asidaa) = cteCap ctea; asid_pool_at' poolPtr sb; ctes_of sb ctSlot = Some ctea; (sc, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sc; cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s')); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) y')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s'))); ret__unsigned_' tb = capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y'))\<rbrakk> \<Longrightarrow> capPDBasePtr (capCap (cteCap ctea)) = capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y'))
 2. \<And>s s' cte y' p asida sa rva sb ctea pa asidaa sc t cap ta capa tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid_pool_at' poolPtr s; asid < 2 ^ local.asid_bits; ctes_of s ctSlot = Some cte; cslift s' (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida)) (cte_C.cap_C y'); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); (sa, s') \<in> rf_sr; \<forall>ko. ko_at' ko poolPtr sa \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte \<and> cteCap ctea = cteCap cte) \<and> (\<exists>p asid. cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asid)) \<and> asid_pool_at' poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte); (sb, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sb; capability.ArchObjectCap (arch_capability.PageDirectoryCap pa asidaa) = cteCap ctea; asid_pool_at' poolPtr sb; ctes_of sb ctSlot = Some ctea; (sc, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sc; cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s')); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) y')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s'))); ret__unsigned_' tb = capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y'))\<rbrakk> \<Longrightarrow> unat (2 ^ local.asid_low_bits - 1) < CARD(1024) proof (prove)
goal (2 subgoals):
 1. \<And>s s' cte y' p asida sa rva sb ctea pa asidaa sc t cap ta capa tb cte' ctel'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid_pool_at' poolPtr s; asid < 2 ^ local.asid_bits; ctes_of s ctSlot = Some cte; cslift s' (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida)) (cte_C.cap_C y'); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); (sa, s') \<in> rf_sr; \<forall>ko. ko_at' ko poolPtr sa \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte \<and> cteCap ctea = cteCap cte) \<and> (\<exists>p asid. cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asid)) \<and> asid_pool_at' poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte); (sb, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sb; capability.ArchObjectCap (arch_capability.PageDirectoryCap pa asidaa) = cteCap ctea; asid_pool_at' poolPtr sb; (sc, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sc; cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s')); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) y')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s'))); ret__unsigned_' tb = capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y')); ctes_of sb ctSlot = Some (cte_to_H ctel'); cslift s' (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some ctel'; ctea = cte_to_H ctel'; cl_valid_cte ctel'\<rbrakk> \<Longrightarrow> capPDBasePtr (capCap (cap_to_H (cap_CL ctel'))) = capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y'))
 2. \<And>s s' cte y' p asida sa rva sb ctea pa asidaa sc t cap ta capa tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid_pool_at' poolPtr s; asid < 2 ^ local.asid_bits; ctes_of s ctSlot = Some cte; cslift s' (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida)) (cte_C.cap_C y'); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); (sa, s') \<in> rf_sr; \<forall>ko. ko_at' ko poolPtr sa \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte \<and> cteCap ctea = cteCap cte) \<and> (\<exists>p asid. cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asid)) \<and> asid_pool_at' poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte); (sb, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sb; capability.ArchObjectCap (arch_capability.PageDirectoryCap pa asidaa) = cteCap ctea; asid_pool_at' poolPtr sb; ctes_of sb ctSlot = Some ctea; (sc, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sc; cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s')); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) y')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s'))); ret__unsigned_' tb = capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y'))\<rbrakk> \<Longrightarrow> unat (2 ^ local.asid_low_bits - 1) < CARD(1024) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte y' p asida sa rva sb ctea pa asidaa sc t cap ta capa tb. \<lbrakk>(s, s') \<in> rf_sr; invs' s; asid_pool_at' poolPtr s; asid < 2 ^ local.asid_bits; ctes_of s ctSlot = Some cte; cslift s' (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida)) (cte_C.cap_C y'); cteCap cte = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asida); (sa, s') \<in> rf_sr; \<forall>ko. ko_at' ko poolPtr sa \<longrightarrow> ko_at' (asidpool.ASIDPool (SOME x. asidpool.ASIDPool x = ko)) poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte \<and> cteCap ctea = cteCap cte) \<and> (\<exists>p asid. cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap p asid)) \<and> asid_pool_at' poolPtr sa \<and> (\<exists>cte. ctes_of sa ctSlot = Some cte); (sb, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sb; capability.ArchObjectCap (arch_capability.PageDirectoryCap pa asidaa) = cteCap ctea; asid_pool_at' poolPtr sb; ctes_of sb ctSlot = Some ctea; (sc, s') \<in> rf_sr; ko_at' (asidpool.ASIDPool rva) poolPtr sc; cap_page_directory_cap_lift cap = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF\<rparr>; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s')); cap_page_directory_cap_lift capa = cap_page_directory_cap_lift (cte_C.cap_C y')\<lparr>capPDMappedASID_CL := asid && 0x1FFFF, capPDIsMapped_CL := 1\<rparr>; cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capa) y')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) y')) (t_hrs_' (globals s'))); ret__unsigned_' tb = capPDBasePtr_CL (cap_page_directory_cap_lift (cte_C.cap_C y'))\<rbrakk> \<Longrightarrow> unat (2 ^ local.asid_low_bits - 1) < CARD(1024) proof (prove)
goal:
No subgoals!