theory Arch_C

lemma performASIDControlInvocation_ccorres:
notes replicate_numeral[simp del]
shows
  "ccorres (K (K \<bottom>) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_')
             (invs'
               and ct_active'
               and sch_act_simple
               and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent
               and (\<lambda>s. descendants_of' parent (ctes_of s) = {})
               and ex_cte_cap_to' parent
               and (\<lambda>_. base \<le> mask asid_bits \<and> is_aligned base asid_low_bits))
             (UNIV \<inter> {s. frame_' s = Ptr frame}
                   \<inter> {s. slot_' s = cte_Ptr slot}
                   \<inter> {s. parent_' s = cte_Ptr parent}
                   \<inter> {s. asid_base_' s = base}) []
       (liftE (performASIDControlInvocation (MakePool frame slot parent base)))
       (Call performASIDControlInvocation_'proc)" apply (rule ccorres_gen_asm) apply (simp only: liftE_liftM ccorres_liftM_simp) apply (cinit lift: frame_' slot_' parent_' asid_base_') apply (rule_tac P="is_aligned frame pageBits" in ccorres_gen_asm) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_split_nothrow[where c="Seq c c'" for c c']) apply (fold pageBits_def)[1] apply (simp add: hrs_htd_update) apply (rule deleteObjects_ccorres) apply ceqv apply (rule ccorres_rhs_assoc2) apply (rule ccorres_abstract_cleanup) apply (rule ccorres_symb_exec_l) apply (rename_tac pcap) apply (rule_tac P = "pcap = (capability.UntypedCap isdev frame pageBits idx)"
                 in ccorres_gen_asm) apply (simp add: hrs_htd_update del:fun_upd_apply) apply (rule ccorres_split_nothrow) apply (rule_tac cap'="UntypedCap isdev frame pageBits idx" in updateFreeIndex_ccorres) apply (rule allI, rule conseqPre, vcg) apply (rule subsetI, clarsimp simp: typ_heap_simps' pageBits_def isCap_simps) apply (frule ccte_relation_ccap_relation, clarsimp) apply (frule cap_get_tag_isCap_unfolded_H_cap) apply (clarsimp simp: isCap_simps cap_lift_untyped_cap
                                  cap_to_H_simps cap_untyped_cap_lift_def
                                  ccap_relation_def modify_map_def
                                  fun_eq_iff
                          dest!: word_unat.Rep_inverse' split: if_split) apply (rule exI, strengthen refl) apply (case_tac cte', simp add: cap_lift_untyped_cap max_free_index_def mask_def) apply (simp add: mex_def meq_def del: split_paired_Ex) apply blast apply ceqv apply ccorres_remove_UNIV_guard apply (rule ccorres_Guard_Seq[where F=ShiftError])+ apply (ctac (c_lines 2) add:createObjects_asidpool_ccorres[where idx="max_free_index pageBits"]
                              pre del: ccorres_Guard_Seq) apply csymbr apply (ctac (no_vcg) add: cteInsert_ccorres) apply (simp add: ccorres_seq_skip del: fun_upd_apply) apply (rule ccorres_assert) apply (rule_tac P=\<top> and P'=UNIV in ccorres_from_vcg_throws) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: gets_def modify_def return_def put_def get_def bind_def
                             asid_shiftr_low_bits_less
                   simp del: fun_upd_apply Collect_const) apply (clarsimp simp: word_sle_def word_sless_def Kernel_C.asidLowBits_def simp del: fun_upd_apply) apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def cmachine_state_relation_def  simp del: fun_upd_apply) apply (clarsimp simp: carch_state_relation_def carch_globals_def simp del: fun_upd_apply) apply (simp add: asid_high_bits_of_def fun_upd_def[symmetric]
                          del: fun_upd_apply) apply (erule array_relation_update) apply (simp add: unat_ucast) apply (drule leq_asid_bits_shift) apply (simp add: asid_high_bits_def mask_def word_le_nat_alt) apply simp apply (clarsimp simp: option_to_ptr_def option_to_0_def) apply (clarsimp simp: asid_high_bits_def) apply wp+ apply (strengthen valid_pspace_mdb' vp_strgs' valid_pspace_valid_objs') apply (clarsimp simp: is_simple_cap'_def isCap_simps conj_comms placeNewObject_def2) apply (wp createObjects_valid_pspace'[where ty="Inl (KOArch (KOASIDPool f))" and sz = pageBits]
                      createObjects_cte_wp_at'[where sz = pageBits]
                   | simp add:makeObjectKO_def objBits_simps archObjSize_def range_cover_full)+ apply (clarsimp simp:valid_cap'_def capAligned_def) apply (wp createObject_typ_at') apply clarsimp apply vcg apply (clarsimp simp:conj_comms objBits_simps archObjSize_def |
                 strengthen valid_pspace_mdb' vp_strgs' invs_valid_pspace'
                 valid_pspace_valid_objs' invs_valid_global'
                 invs_urz)+ apply (wp updateFreeIndex_forward_invs'
                    updateFreeIndex_caps_no_overlap''[where sz=pageBits]
                    updateFreeIndex_pspace_no_overlap'[where sz=pageBits]
                    updateFreeIndex_caps_overlap_reserved
                    updateFreeIndex_cte_wp_at
                    ) apply (strengthen exI[where x=parent]) apply (wp updateFreeIndex_cte_wp_at) apply clarsimp apply vcg apply wp apply clarsimp apply (wp getSlotCap_wp) apply clarsimp apply (rule_tac Q="\<lambda>_. cte_wp_at' ((=) (UntypedCap isdev frame pageBits idx) o cteCap) parent
                           and (\<lambda>s. descendants_range_in' {frame..frame + (2::word32) ^ pageBits - (1::word32)} parent (ctes_of s))
                           and pspace_no_overlap' frame pageBits
                           and invs'
                           and ct_active'"
                 in hoare_post_imp) apply (clarsimp simp: cte_wp_at_ctes_of invs_valid_objs' range_cover_full word_bits_conv
                           pageBits_def max_free_index_def asid_low_bits_def untypedBits_defs) apply (case_tac cte,clarsimp simp:invs_valid_pspace') apply (frule(1) ctes_of_valid_cap'[OF _ invs_valid_objs']) apply (clarsimp simp:valid_cap'_def asid_low_bits_def invs_urz) apply (strengthen descendants_range_in_subseteq'[mk_strg I E] refl) apply simp apply (intro conjI) apply (simp add:is_aligned_def) apply (rule descendants_range_caps_no_overlapI'[where d=isdev and cref = parent]) apply simp apply (fastforce simp:cte_wp_at_ctes_of is_aligned_neg_mask_eq) apply (clarsimp simp:is_aligned_neg_mask_eq) apply (rule le_m1_iff_lt[THEN iffD1,THEN iffD1]) apply (simp add:asid_bits_def) apply (simp add:mask_def) apply (clarsimp dest!: upto_intvl_eq) apply (wp deleteObjects_cte_wp_at'[where d=isdev and idx = idx and p = parent]
              deleteObjects_descendants[where d=isdev and p = parent and idx = idx]
              deleteObjects_invs'[where d=isdev and p = parent and idx = idx]
              Detype_R.deleteObjects_descendants[where p = parent and idx = idx]
              deleteObjects_ct_active'[where d=isdev and cref = parent and idx = idx]) apply clarsimp apply vcg apply (clarsimp simp: conj_comms invs_valid_pspace') apply (frule cte_wp_at_valid_objs_valid_cap', fastforce) apply (clarsimp simp: valid_cap'_def capAligned_def cte_wp_at_ctes_of untypedBits_defs
                        descendants_range'_def2 empty_descendants_range_in') apply (intro conjI; (rule refl)?) apply clarsimp apply (drule(1) cte_cap_in_untyped_range[where ptr = frame]) apply (fastforce simp: cte_wp_at_ctes_of) apply assumption+ apply fastforce apply simp apply assumption apply simp apply simp apply (erule empty_descendants_range_in') apply (fastforce) apply (erule(1) cmap_relationE1[OF cmap_relation_cte]) apply (clarsimp simp: typ_heap_simps cap_get_tag_isCap dest!: ccte_relation_ccap_relation) apply (clarsimp simp: is_aligned_mask max_free_index_def pageBits_def
                        gen_framesize_to_H_def) apply (rule conjI, rule UNIV_I)? apply clarsimp? apply (erule_tac s = sa in rf_sr_ctes_of_cliftE) apply assumption apply (frule_tac s = sa in rf_sr_cte_relation) apply simp+ apply (clarsimp simp:typ_heap_simps' region_is_bytes'_def[where sz=0]) apply (frule ccte_relation_ccap_relation) apply (clarsimp simp: cap_get_tag_isCap hrs_htd_update) apply (clarsimp simp: hrs_htd_update_def split_def
                         pageBits_def
                   split: if_split) apply (clarsimp simp: ARMSmallPageBits_def word_sle_def is_aligned_mask[symmetric]
                        ghost_assertion_data_get_gs_clear_region) apply (subst ghost_assertion_size_logic_flex[unfolded o_def, rotated]) apply assumption apply (simp add: ghost_assertion_data_get_gs_clear_region) apply (drule valid_global_refsD_with_objSize, clarsimp)+ apply (clarsimp simp: isCap_simps dest!: ccte_relation_ccap_relation) apply (cut_tac ptr=frame and bits=12
    and htd="typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))" in typ_region_bytes_actually_is_bytes) apply (simp add: hrs_htd_update) apply (clarsimp simp: region_actually_is_bytes'_def[where len=0]) apply (intro conjI) apply (clarsimp elim!:is_aligned_weaken) apply (simp add:is_aligned_def) apply (simp add: hrs_htd_def) apply (erule is_aligned_no_wrap',simp) apply (drule region_actually_is_bytes_dom_s[OF _ order_refl]) apply (simp add: hrs_htd_def split_def) apply (clarsimp simp: ccap_relation_def) apply (clarsimp simp: cap_asid_pool_cap_lift) apply (clarsimp simp: cap_to_H_def) apply (drule word_le_mask_eq) apply (simp add: asid_bits_def) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (K (K (\<lambda>_. False)) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent and (\<lambda>_. base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits)) (UNIV \<inter> \<lbrace>\<acute>frame = PTR(unit) frame\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>parent = cte_Ptr parent\<rbrace> \<inter> \<lbrace>\<acute>asid_base = base\<rbrace>) [] (liftE (performASIDControlInvocation (asidcontrol_invocation.MakePool frame slot parent base))) (Call performASIDControlInvocation_'proc) proof (prove)
goal (1 subgoal):
 1. base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) (UNIV \<inter> \<lbrace>\<acute>frame = PTR(unit) frame\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>parent = cte_Ptr parent\<rbrace> \<inter> \<lbrace>\<acute>asid_base = base\<rbrace>) [] (liftE (performASIDControlInvocation (asidcontrol_invocation.MakePool frame slot parent base))) (Call performASIDControlInvocation_'proc) proof (prove)
goal (1 subgoal):
 1. base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) (UNIV \<inter> \<lbrace>\<acute>frame = PTR(unit) frame\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>parent = cte_Ptr parent\<rbrace> \<inter> \<lbrace>\<acute>asid_base = base\<rbrace>) [] (performASIDControlInvocation (asidcontrol_invocation.MakePool frame slot parent base)) (Call performASIDControlInvocation_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1514 asid_base parenta slota framea) (?Q'1514 asid_base parenta slota framea) [SKIP] (do y <- deleteObjects frame pageBits;
pcap <- getSlotCap parent;
y <- updateFreeIndex parent (max_free_index (capBlockSize pcap));
y <- placeNewObject frame makeObject 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot;
y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
(\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c parenta} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c parenta} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(parenta\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))));;
(Guard ShiftError \<lbrace>0 \<le>s ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>2 ^ unat ARMSmallPageBits < 2147483648\<rbrace> (CALL memzero_'proc(framea,SCAST(32 signed \<rightarrow> 32) (1 << unat ARMSmallPageBits))));;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea))));;
(\<acute>ret__struct_cap_C :== CALL cap_asid_pool_cap_new_'proc(UCAST(32 \<rightarrow> 32) asid_base,UCAST(32 \<rightarrow> 32) (ptr_val framea));;
(CALL cteInsert_'proc(\<acute>ret__struct_cap_C,parenta,slota);;
(Guard ArrayBounds \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (asid_base >> local.asid_low_bits)) (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1514 asid_base parenta slota framea s \<and> s' \<in> ?Q'1514 asid_base parenta slota framea proof (prove)
goal (2 subgoals):
 1. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?G1520 asid_base parenta slota framea) (?Q'1514 asid_base parenta slota framea) [SKIP] (do y <- deleteObjects frame pageBits;
pcap <- getSlotCap parent;
y <- updateFreeIndex parent (max_free_index (capBlockSize pcap));
y <- placeNewObject frame makeObject 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot;
y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
(\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c parenta} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c parenta} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(parenta\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))));;
(Guard ShiftError \<lbrace>0 \<le>s ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>2 ^ unat ARMSmallPageBits < 2147483648\<rbrace> (CALL memzero_'proc(framea,SCAST(32 signed \<rightarrow> 32) (1 << unat ARMSmallPageBits))));;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea))));;
(\<acute>ret__struct_cap_C :== CALL cap_asid_pool_cap_new_'proc(UCAST(32 \<rightarrow> 32) asid_base,UCAST(32 \<rightarrow> 32) (ptr_val framea));;
(CALL cteInsert_'proc(\<acute>ret__struct_cap_C,parenta,slota);;
(Guard ArrayBounds \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (asid_base >> local.asid_low_bits)) (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?G1520 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> ?Q'1514 asid_base parenta slota framea proof (prove)
goal (2 subgoals):
 1. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?G1520 asid_base parenta slota framea) (?Q'1514 asid_base parenta slota framea) [SKIP] (do y <- deleteObjects frame pageBits;
pcap <- getSlotCap parent;
y <- updateFreeIndex parent (max_free_index (capBlockSize pcap));
y <- placeNewObject frame makeObject 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot;
y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c parenta} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c parenta} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(parenta\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))));;
(Guard ShiftError \<lbrace>0 \<le>s ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>2 ^ unat ARMSmallPageBits < 2147483648\<rbrace> (CALL memzero_'proc(framea,SCAST(32 signed \<rightarrow> 32) (1 << unat ARMSmallPageBits))));;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea))));;
(\<acute>ret__struct_cap_C :== CALL cap_asid_pool_cap_new_'proc(UCAST(32 \<rightarrow> 32) asid_base,UCAST(32 \<rightarrow> 32) (ptr_val framea));;
(CALL cteInsert_'proc(\<acute>ret__struct_cap_C,parenta,slota);;
(Guard ArrayBounds \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (asid_base >> local.asid_low_bits)) (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 2. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?G1520 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> ?Q'1514 asid_base parenta slota framea proof (prove)
goal (6 subgoals):
 1. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> ccorres (?r'1523 asid_base parenta slota framea) (?xf'1523 asid_base parenta slota framea) (?P1523 asid_base parenta slota framea) (?P'1523 asid_base parenta slota framea) [SKIP] (deleteObjects frame pageBits) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12))
 2. \<And>asid_base parenta slota framea rv' t t'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'1523 asid_base parenta slota framea) rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c parenta} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c parenta} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(parenta\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))));;
(Guard ShiftError \<lbrace>0 \<le>s ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>2 ^ unat ARMSmallPageBits < 2147483648\<rbrace> (CALL memzero_'proc(framea,SCAST(32 signed \<rightarrow> 32) (1 << unat ARMSmallPageBits))));;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea))));;
(\<acute>ret__struct_cap_C :== CALL cap_asid_pool_cap_new_'proc(UCAST(32 \<rightarrow> 32) asid_base,UCAST(32 \<rightarrow> 32) (ptr_val framea));;
(CALL cteInsert_'proc(\<acute>ret__struct_cap_C,parenta,slota);;
(Guard ArrayBounds \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (asid_base >> local.asid_low_bits)) (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))) (?d'1523 asid_base parenta slota framea rv')
 3. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; ?r'1523 asid_base parenta slota framea y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1523 asid_base parenta slota framea y) (?Q'1523 asid_base parenta slota framea y rv') [SKIP] (do pcap <- getSlotCap parent;
y <- updateFreeIndex parent (max_free_index (capBlockSize pcap));
y <- placeNewObject frame makeObject 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot;
y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) (?d'1523 asid_base parenta slota framea rv')
 4. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 5. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. ?r'1523 asid_base parenta slota framea y (?xf'1523 asid_base parenta slota framea s) \<longrightarrow> s \<in> ?Q'1523 asid_base parenta slota framea y (?xf'1523 asid_base parenta slota framea s)}
 6. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P1523 asid_base parenta slota framea and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> ?P'1523 asid_base parenta slota framea \<inter> ?R'1523 asid_base parenta slota framea proof (prove)
goal (6 subgoals):
 1. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> ccorres (?r'1523 asid_base parenta slota framea) (?xf'1523 asid_base parenta slota framea) (?P1523 asid_base parenta slota framea) (?P'1523 asid_base parenta slota framea) [SKIP] (deleteObjects frame pageBits) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) pageBits) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) pageBits)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) pageBits))
 2. \<And>asid_base parenta slota framea rv' t t'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'1523 asid_base parenta slota framea) rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c parenta} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c parenta} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(parenta\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))));;
(Guard ShiftError \<lbrace>0 \<le>s ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>2 ^ unat ARMSmallPageBits < 2147483648\<rbrace> (CALL memzero_'proc(framea,SCAST(32 signed \<rightarrow> 32) (1 << unat ARMSmallPageBits))));;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea))));;
(\<acute>ret__struct_cap_C :== CALL cap_asid_pool_cap_new_'proc(UCAST(32 \<rightarrow> 32) asid_base,UCAST(32 \<rightarrow> 32) (ptr_val framea));;
(CALL cteInsert_'proc(\<acute>ret__struct_cap_C,parenta,slota);;
(Guard ArrayBounds \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (asid_base >> local.asid_low_bits)) (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))) (?d'1523 asid_base parenta slota framea rv')
 3. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; ?r'1523 asid_base parenta slota framea y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1523 asid_base parenta slota framea y) (?Q'1523 asid_base parenta slota framea y rv') [SKIP] (do pcap <- getSlotCap parent;
y <- updateFreeIndex parent (max_free_index (capBlockSize pcap));
y <- placeNewObject frame makeObject 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot;
y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) (?d'1523 asid_base parenta slota framea rv')
 4. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 5. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. ?r'1523 asid_base parenta slota framea y (?xf'1523 asid_base parenta slota framea s) \<longrightarrow> s \<in> ?Q'1523 asid_base parenta slota framea y (?xf'1523 asid_base parenta slota framea s)}
 6. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P1523 asid_base parenta slota framea and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> ?P'1523 asid_base parenta slota framea \<inter> ?R'1523 asid_base parenta slota framea proof (prove)
goal (6 subgoals):
 1. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> ccorres (?r'1523 asid_base parenta slota framea) (?xf'1523 asid_base parenta slota framea) (?P1523 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) (?P'1523 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) [SKIP] (deleteObjects frame pageBits) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (typ_region_bytes frame pageBits (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes frame pageBits)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region frame pageBits))
 2. \<And>asid_base parenta slota framea rv' t t'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'1523 asid_base parenta slota framea) rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c parenta} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c parenta} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(parenta\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))));;
(Guard ShiftError \<lbrace>0 \<le>s ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>2 ^ unat ARMSmallPageBits < 2147483648\<rbrace> (CALL memzero_'proc(framea,SCAST(32 signed \<rightarrow> 32) (1 << unat ARMSmallPageBits))));;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea))));;
(\<acute>ret__struct_cap_C :== CALL cap_asid_pool_cap_new_'proc(UCAST(32 \<rightarrow> 32) asid_base,UCAST(32 \<rightarrow> 32) (ptr_val framea));;
(CALL cteInsert_'proc(\<acute>ret__struct_cap_C,parenta,slota);;
(Guard ArrayBounds \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (asid_base >> local.asid_low_bits)) (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))) (?d'1523 asid_base parenta slota framea rv')
 3. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; ?r'1523 asid_base parenta slota framea y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1523 asid_base parenta slota framea y) (?Q'1523 asid_base parenta slota framea y rv') [SKIP] (do pcap <- getSlotCap parent;
y <- updateFreeIndex parent (max_free_index (capBlockSize pcap));
y <- placeNewObject frame makeObject 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot;
y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) (?d'1523 asid_base parenta slota framea rv')
 4. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 5. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. ?r'1523 asid_base parenta slota framea y (?xf'1523 asid_base parenta slota framea s) \<longrightarrow> s \<in> ?Q'1523 asid_base parenta slota framea y (?xf'1523 asid_base parenta slota framea s)}
 6. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P1523 asid_base parenta slota framea and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> ?P'1523 asid_base parenta slota framea \<inter> ?R'1523 asid_base parenta slota framea proof (prove)
goal (5 subgoals):
 1. \<And>asid_base parenta slota framea rv' t t'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Guard C_Guard {s. s \<Turnstile>\<^sub>c parenta} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c parenta} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(parenta\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))));;
(Guard ShiftError \<lbrace>0 \<le>s ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>2 ^ unat ARMSmallPageBits < 2147483648\<rbrace> (CALL memzero_'proc(framea,SCAST(32 signed \<rightarrow> 32) (1 << unat ARMSmallPageBits))));;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea))));;
(\<acute>ret__struct_cap_C :== CALL cap_asid_pool_cap_new_'proc(UCAST(32 \<rightarrow> 32) asid_base,UCAST(32 \<rightarrow> 32) (ptr_val framea));;
(CALL cteInsert_'proc(\<acute>ret__struct_cap_C,parenta,slota);;
(Guard ArrayBounds \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (asid_base >> local.asid_low_bits)) (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))) (?d'1523 asid_base parenta slota framea rv')
 2. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1523 asid_base parenta slota framea y) (?Q'1523 asid_base parenta slota framea y rv') [SKIP] (do pcap <- getSlotCap parent;
y <- updateFreeIndex parent (max_free_index (capBlockSize pcap));
y <- placeNewObject frame makeObject 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot;
y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) (?d'1523 asid_base parenta slota framea rv')
 3. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 4. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1523 asid_base parenta slota framea y (xfdc s)}
 5. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (4 subgoals):
 1. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1523 asid_base parenta slota framea y) (?Q'1523 asid_base parenta slota framea y rv') [SKIP] (do pcap <- getSlotCap parent;
y <- updateFreeIndex parent (max_free_index (capBlockSize pcap));
y <- placeNewObject frame makeObject 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot;
y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c parenta} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c parenta} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(parenta\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))));;
(Guard ShiftError \<lbrace>0 \<le>s ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>2 ^ unat ARMSmallPageBits < 2147483648\<rbrace> (CALL memzero_'proc(framea,SCAST(32 signed \<rightarrow> 32) (1 << unat ARMSmallPageBits))));;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea))));;
(\<acute>ret__struct_cap_C :== CALL cap_asid_pool_cap_new_'proc(UCAST(32 \<rightarrow> 32) asid_base,UCAST(32 \<rightarrow> 32) (ptr_val framea));;
(CALL cteInsert_'proc(\<acute>ret__struct_cap_C,parenta,slota);;
(Guard ArrayBounds \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== armKSASIDTable_'_update (\<lambda>_. Arrays.update \<acute>armKSASIDTable (unat (asid_base >> local.asid_low_bits)) (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea)))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))
 2. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 3. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1523 asid_base parenta slota framea y (xfdc s)}
 4. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (4 subgoals):
 1. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1523 asid_base parenta slota framea y) (?Q'1523 asid_base parenta slota framea y rv') [SKIP] (do pcap <- getSlotCap parent;
y <- updateFreeIndex parent (max_free_index (capBlockSize pcap));
y <- placeNewObject frame makeObject 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot;
y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c parenta} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c parenta} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(parenta\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))));;
(Guard ShiftError \<lbrace>0 \<le>s ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>2 ^ unat ARMSmallPageBits < 2147483648\<rbrace> (CALL memzero_'proc(framea,SCAST(32 signed \<rightarrow> 32) (1 << unat ARMSmallPageBits))));;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea))));;
(\<acute>ret__struct_cap_C :== CALL cap_asid_pool_cap_new_'proc(UCAST(32 \<rightarrow> 32) asid_base,UCAST(32 \<rightarrow> 32) (ptr_val framea));;
(CALL cteInsert_'proc(\<acute>ret__struct_cap_C,parenta,slota);;
(Guard ArrayBounds \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== armKSASIDTable_'_update (\<lambda>_. Arrays.update \<acute>armKSASIDTable (unat (asid_base >> local.asid_low_bits)) (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea)))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 3. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1523 asid_base parenta slota framea y (xfdc s)}
 4. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (4 subgoals):
 1. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1523 asid_base parenta slota framea y) (?G'1570 asid_base parenta slota framea y rv') [SKIP] (do pcap <- getSlotCap parent;
y <- updateFreeIndex parent (max_free_index (capBlockSize pcap));
y <- placeNewObject frame makeObject 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot;
y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c parenta} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c parenta} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(parenta\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))));;
(Guard ShiftError \<lbrace>0 \<le>s ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>2 ^ unat ARMSmallPageBits < 2147483648\<rbrace> (CALL memzero_'proc(framea,SCAST(32 signed \<rightarrow> 32) (1 << unat ARMSmallPageBits))));;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea))));;
(\<acute>ret__struct_cap_C :== CALL cap_asid_pool_cap_new_'proc(UCAST(32 \<rightarrow> 32) asid_base,UCAST(32 \<rightarrow> 32) (ptr_val framea));;
(CALL cteInsert_'proc(\<acute>ret__struct_cap_C,parenta,slota);;
(Guard ArrayBounds \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== armKSASIDTable_'_update (\<lambda>_. Arrays.update \<acute>armKSASIDTable (unat (asid_base >> local.asid_low_bits)) (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea)))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 3. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> ?G'1570 asid_base parenta slota framea y (xfdc s)} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 4. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (7 subgoals):
 1. \<And>asid_base parenta slota framea y rv' rv. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1573 asid_base parenta slota framea y rv' rv) (?Q'1573 asid_base parenta slota framea y rv' rv) [SKIP] (do y <- updateFreeIndex parent (max_free_index (capBlockSize rv));
y <- placeNewObject frame makeObject 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot;
y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c parenta} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c parenta} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(parenta\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))));;
(Guard ShiftError \<lbrace>0 \<le>s ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>2 ^ unat ARMSmallPageBits < 2147483648\<rbrace> (CALL memzero_'proc(framea,SCAST(32 signed \<rightarrow> 32) (1 << unat ARMSmallPageBits))));;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea))));;
(\<acute>ret__struct_cap_C :== CALL cap_asid_pool_cap_new_'proc(UCAST(32 \<rightarrow> 32) asid_base,UCAST(32 \<rightarrow> 32) (ptr_val framea));;
(CALL cteInsert_'proc(\<acute>ret__struct_cap_C,parenta,slota);;
(Guard ArrayBounds \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== armKSASIDTable_'_update (\<lambda>_. Arrays.update \<acute>armKSASIDTable (unat (asid_base >> local.asid_low_bits)) (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea)))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>?Q1573 asid_base parenta slota framea y rv'\<rbrace>
 4. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 5. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 6. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> ?Q1573 asid_base parenta slota framea y (xfdc s) rv sa \<longrightarrow> s' \<in> ?Q'1573 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 7. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (7 subgoals):
 1. \<And>asid_base parenta slota framea y rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1573 asid_base parenta slota framea y rv' pcap) (?Q'1573 asid_base parenta slota framea y rv' pcap) [SKIP] (do y <- updateFreeIndex parent (max_free_index (capBlockSize pcap));
y <- placeNewObject frame makeObject 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot;
y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c parenta} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c parenta} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(parenta\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))));;
(Guard ShiftError \<lbrace>0 \<le>s ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>2 ^ unat ARMSmallPageBits < 2147483648\<rbrace> (CALL memzero_'proc(framea,SCAST(32 signed \<rightarrow> 32) (1 << unat ARMSmallPageBits))));;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea))));;
(\<acute>ret__struct_cap_C :== CALL cap_asid_pool_cap_new_'proc(UCAST(32 \<rightarrow> 32) asid_base,UCAST(32 \<rightarrow> 32) (ptr_val framea));;
(CALL cteInsert_'proc(\<acute>ret__struct_cap_C,parenta,slota);;
(Guard ArrayBounds \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== armKSASIDTable_'_update (\<lambda>_. Arrays.update \<acute>armKSASIDTable (unat (asid_base >> local.asid_low_bits)) (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea)))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>?Q1573 asid_base parenta slota framea y rv'\<rbrace>
 4. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 5. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 6. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> ?Q1573 asid_base parenta slota framea y (xfdc s) rv sa \<longrightarrow> s' \<in> ?Q'1573 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 7. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (7 subgoals):
 1. \<And>asid_base parenta slota framea y rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?G1580 asid_base parenta slota framea y rv' pcap) (?Q'1573 asid_base parenta slota framea y rv' pcap) [SKIP] (do y <- updateFreeIndex parent (max_free_index (capBlockSize pcap));
y <- placeNewObject frame makeObject 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot;
y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c parenta} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c parenta} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(parenta\<rightarrow>[''cap_C'']),UCAST(32 \<rightarrow> 32) (1 << unat (\<acute>ret__unsigned - SCAST(32 signed \<rightarrow> 32) 4)))));;
(Guard ShiftError \<lbrace>0 \<le>s ARMSmallPageBits\<rbrace> (Guard ShiftError \<lbrace>2 ^ unat ARMSmallPageBits < 2147483648\<rbrace> (CALL memzero_'proc(framea,SCAST(32 signed \<rightarrow> 32) (1 << unat ARMSmallPageBits))));;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea))));;
(\<acute>ret__struct_cap_C :== CALL cap_asid_pool_cap_new_'proc(UCAST(32 \<rightarrow> 32) asid_base,UCAST(32 \<rightarrow> 32) (ptr_val framea));;
(CALL cteInsert_'proc(\<acute>ret__struct_cap_C,parenta,slota);;
(Guard ArrayBounds \<lbrace>asid_base >> local.asid_low_bits < 0x80\<rbrace> (Guard ShiftError \<lbrace>0 \<le>s Kernel_C.asidLowBits\<rbrace> (Guard ShiftError \<lbrace>Kernel_C.asidLowBits <s 0x20\<rbrace> (\<acute>globals :== armKSASIDTable_'_update (\<lambda>_. Arrays.update \<acute>armKSASIDTable (unat (asid_base >> local.asid_low_bits)) (PTR_COERCE(unit \<rightarrow> asid_pool_C) framea)))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. ?G1580 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 4. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 5. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 6. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (?G1580 asid_base parenta slota framea y (xfdc s) rv and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> ?Q'1573 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 7. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (7 subgoals):
 1. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?G1580 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) (?Q'1573 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) [SKIP] (do y <- updateFreeIndex parent (max_free_index pageBits);
y <- placeNewObject frame makeObject 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot;
y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (\<lambda>a. armKSASIDTable (ksArchState a));
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4))));;
(Guard ShiftError (if 0 \<le>s ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) (CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits)));;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame))));;
(\<acute>ret__struct_cap_C :== CALL cap_asid_pool_cap_new_'proc(base,frame);;
(CALL cteInsert_'proc(\<acute>ret__struct_cap_C,cte_Ptr parent,cte_Ptr slot);;
(Guard ArrayBounds (if base >> local.asid_low_bits < 0x80 then UNIV else {}) (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) (ap_Ptr frame))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. ?G1580 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 4. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 5. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 6. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (?G1580 asid_base parenta slota framea y (xfdc s) rv and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> ?Q'1573 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 7. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (11 subgoals):
 1. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> ccorres (?r'1592 asid_base parenta slota framea rv' pcap) (?xf'1592 asid_base parenta slota framea rv' pcap) (?P1602 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) (?P'1595 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) [SKIP] (updateFreeIndex parent (max_free_index pageBits)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))))
 2. \<And>asid_base parenta slota framea rv' pcap rv'a t t'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'1592 asid_base parenta slota framea rv' pcap) rv'a t t' (Guard ShiftError (if 0 \<le>s ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) (CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits)));;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame))));;
(\<acute>ret__struct_cap_C :== CALL cap_asid_pool_cap_new_'proc(base,frame);;
(CALL cteInsert_'proc(\<acute>ret__struct_cap_C,cte_Ptr parent,cte_Ptr slot);;
(Guard ArrayBounds (if base >> local.asid_low_bits < 0x80 then UNIV else {}) (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) (ap_Ptr frame))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) (?d'1592 asid_base parenta slota framea rv' pcap rv'a)
 3. \<And>asid_base parenta slota framea rv' pcap y rv'a. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; ?r'1592 asid_base parenta slota framea rv' pcap y rv'a\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1592 asid_base parenta slota framea rv' pcap y) (?Q'1592 asid_base parenta slota framea rv' pcap y rv'a) [SKIP] (do y <- placeNewObject frame makeObject 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot;
y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (\<lambda>a. armKSASIDTable (ksArchState a));
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) (?d'1592 asid_base parenta slota framea rv' pcap rv'a)
 4. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>?Q1592 asid_base parenta slota framea rv' pcap\<rbrace>
 5. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. ?r'1592 asid_base parenta slota framea rv' pcap y (?xf'1592 asid_base parenta slota framea rv' pcap s) \<longrightarrow> s \<in> ?Q'1592 asid_base parenta slota framea rv' pcap y (?xf'1592 asid_base parenta slota framea rv' pcap s)}
 6. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. ?P1602 asid_base parenta slota framea y rv' pcap and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 8. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 9. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 10. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (?P1602 asid_base parenta slota framea y (xfdc s) rv and ?R1600 asid_base parenta slota framea y (xfdc s) rv and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> ?P'1595 asid_base parenta slota framea y (xfdc s) rv \<inter> ?R'1594 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
A total of 11 subgoals...
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (11 subgoals):
 1. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile> ({s} \<inter> {s. \<exists>cte cte'. cslift s (cte_Ptr parent) = Some cte' \<and> cteCap cte = capability.UntypedCap isdev frame pageBits idx \<and> ccte_relation cte cte'}) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {t. \<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (cslift s (cte_Ptr parent))))\<lparr>capFreeIndex_CL := word_of_nat (max_free_index pageBits) >> 4\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cte_Ptr parent))))) (t_hrs_' (globals s)) \<and> t may_only_modify_globals s in [t_hrs]}
 2. \<And>asid_base parenta slota framea rv' pcap rv'a t t'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (Guard ShiftError (if 0 \<le>s ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) (CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits)));;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame))));;
(\<acute>ret__struct_cap_C :== CALL cap_asid_pool_cap_new_'proc(base,frame);;
(CALL cteInsert_'proc(\<acute>ret__struct_cap_C,cte_Ptr parent,cte_Ptr slot);;
(Guard ArrayBounds (if base >> local.asid_low_bits < 0x80 then UNIV else {}) (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) (ap_Ptr frame))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) (?d'1592 asid_base parenta slota framea rv' pcap rv'a)
 3. \<And>asid_base parenta slota framea rv' pcap y rv'a. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1592 asid_base parenta slota framea rv' pcap y) (?Q'1592 asid_base parenta slota framea rv' pcap y rv'a) [SKIP] (do y <- placeNewObject frame makeObject 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot;
y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (\<lambda>a. armKSASIDTable (ksArchState a));
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) (?d'1592 asid_base parenta slota framea rv' pcap rv'a)
 4. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>?Q1592 asid_base parenta slota framea rv' pcap\<rbrace>
 5. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1592 asid_base parenta slota framea rv' pcap y (xfdc s)}
 6. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 8. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 9. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 10. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and ?R1600 asid_base parenta slota framea y (xfdc s) rv and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> ?R'1594 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
A total of 11 subgoals...
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (11 subgoals):
 1. \<And>asid_base parenta slota framea rv' pcap s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> {s} \<inter> {s. \<exists>cte cte'. cslift s (cte_Ptr parent) = Some cte' \<and> cteCap cte = capability.UntypedCap isdev frame pageBits idx \<and> ccte_relation cte cte'} \<subseteq> {sa. sa \<Turnstile>\<^sub>c cte_Ptr parent \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])))) \<longrightarrow> sa \<Turnstile>\<^sub>c cte_Ptr parent \<and> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<and> sa \<Turnstile>\<^sub>c cparent (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift sa (cparent (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (cslift sa (cparent (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift sa (cparent (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals sa))) \<longrightarrow> (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (cslift s (cte_Ptr parent))))\<lparr>capFreeIndex_CL := word_of_nat (max_free_index pageBits) >> 4\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cte_Ptr parent))))) (t_hrs_' (globals s)) \<and> globals sa may_only_modify_globals s in [t_hrs])))}
 2. \<And>asid_base parenta slota framea rv' pcap rv'a t t'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (Guard ShiftError (if 0 \<le>s ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) (CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits)));;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame))));;
(\<acute>ret__struct_cap_C :== CALL cap_asid_pool_cap_new_'proc(base,frame);;
(CALL cteInsert_'proc(\<acute>ret__struct_cap_C,cte_Ptr parent,cte_Ptr slot);;
(Guard ArrayBounds (if base >> local.asid_low_bits < 0x80 then UNIV else {}) (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) (ap_Ptr frame))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) (?d'1592 asid_base parenta slota framea rv' pcap rv'a)
 3. \<And>asid_base parenta slota framea rv' pcap y rv'a. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1592 asid_base parenta slota framea rv' pcap y) (?Q'1592 asid_base parenta slota framea rv' pcap y rv'a) [SKIP] (do y <- placeNewObject frame makeObject 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot;
y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (\<lambda>a. armKSASIDTable (ksArchState a));
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) (?d'1592 asid_base parenta slota framea rv' pcap rv'a)
 4. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>?Q1592 asid_base parenta slota framea rv' pcap\<rbrace>
 5. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1592 asid_base parenta slota framea rv' pcap y (xfdc s)}
 6. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 8. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 9. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 10. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and ?R1600 asid_base parenta slota framea y (xfdc s) rv and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> ?R'1594 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
A total of 11 subgoals...
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (11 subgoals):
 1. \<And>s cte cte'. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base local.asid_low_bits; cslift s (cte_Ptr parent) = Some cte'; cteCap cte = capability.UntypedCap isdev frame 12 idx; ccte_relation cte cte'\<rbrakk> \<Longrightarrow> cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ((\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte')) - 4 < 0x20 \<and> cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte')) - 4) && mask 26\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals s))) \<longrightarrow> (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := word_of_nat (max_free_index 12) >> 4\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals s)) \<and> globals s may_only_modify_globals s in [t_hrs])))
 2. \<And>asid_base parenta slota framea rv' pcap rv'a t t'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (Guard ShiftError (if 0 \<le>s ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) (CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits)));;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame))));;
(\<acute>ret__struct_cap_C :== CALL cap_asid_pool_cap_new_'proc(base,frame);;
(CALL cteInsert_'proc(\<acute>ret__struct_cap_C,cte_Ptr parent,cte_Ptr slot);;
(Guard ArrayBounds (if base >> local.asid_low_bits < 0x80 then UNIV else {}) (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) (ap_Ptr frame))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) (?d'1592 asid_base parenta slota framea rv' pcap rv'a)
 3. \<And>asid_base parenta slota framea rv' pcap y rv'a. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1592 asid_base parenta slota framea rv' pcap y) (?Q'1592 asid_base parenta slota framea rv' pcap y rv'a) [SKIP] (do y <- placeNewObject frame makeObject 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot;
y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (\<lambda>a. armKSASIDTable (ksArchState a));
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) (?d'1592 asid_base parenta slota framea rv' pcap rv'a)
 4. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>?Q1592 asid_base parenta slota framea rv' pcap\<rbrace>
 5. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1592 asid_base parenta slota framea rv' pcap y (xfdc s)}
 6. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 8. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 9. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 10. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and ?R1600 asid_base parenta slota framea y (xfdc s) rv and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> ?R'1594 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
A total of 11 subgoals...
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (11 subgoals):
 1. \<And>s cte cte'. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base local.asid_low_bits; cslift s (cte_Ptr parent) = Some cte'; cteCap cte = capability.UntypedCap isdev frame 12 idx; ccte_relation cte cte'; ccap_relation (capability.UntypedCap isdev frame 12 idx) (cte_C.cap_C cte')\<rbrakk> \<Longrightarrow> cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ((\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte')) - 4 < 0x20 \<and> cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte')) - 4) && mask 26\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals s))) \<longrightarrow> (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := word_of_nat (max_free_index 12) >> 4\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals s)) \<and> globals s may_only_modify_globals s in [t_hrs])))
 2. \<And>asid_base parenta slota framea rv' pcap rv'a t t'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (Guard ShiftError (if 0 \<le>s ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) (CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits)));;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame))));;
(\<acute>ret__struct_cap_C :== CALL cap_asid_pool_cap_new_'proc(base,frame);;
(CALL cteInsert_'proc(\<acute>ret__struct_cap_C,cte_Ptr parent,cte_Ptr slot);;
(Guard ArrayBounds (if base >> local.asid_low_bits < 0x80 then UNIV else {}) (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) (ap_Ptr frame))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) (?d'1592 asid_base parenta slota framea rv' pcap rv'a)
 3. \<And>asid_base parenta slota framea rv' pcap y rv'a. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1592 asid_base parenta slota framea rv' pcap y) (?Q'1592 asid_base parenta slota framea rv' pcap y rv'a) [SKIP] (do y <- placeNewObject frame makeObject 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot;
y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (\<lambda>a. armKSASIDTable (ksArchState a));
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) (?d'1592 asid_base parenta slota framea rv' pcap rv'a)
 4. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>?Q1592 asid_base parenta slota framea rv' pcap\<rbrace>
 5. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1592 asid_base parenta slota framea rv' pcap y (xfdc s)}
 6. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 8. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 9. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 10. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and ?R1600 asid_base parenta slota framea y (xfdc s) rv and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> ?R'1594 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
A total of 11 subgoals...
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (11 subgoals):
 1. \<And>s cte cte'. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base local.asid_low_bits; cslift s (cte_Ptr parent) = Some cte'; cteCap cte = capability.UntypedCap isdev frame 12 idx; ccte_relation cte cte'; ccap_relation (capability.UntypedCap isdev frame 12 idx) (cte_C.cap_C cte'); cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ((\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte')) - 4 < 0x20 \<and> cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte')) - 4) && mask 26\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals s))) \<longrightarrow> (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := word_of_nat (max_free_index 12) >> 4\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals s)) \<and> globals s may_only_modify_globals s in [t_hrs])))
 2. \<And>asid_base parenta slota framea rv' pcap rv'a t t'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (Guard ShiftError (if 0 \<le>s ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) (CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits)));;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame))));;
(\<acute>ret__struct_cap_C :== CALL cap_asid_pool_cap_new_'proc(base,frame);;
(CALL cteInsert_'proc(\<acute>ret__struct_cap_C,cte_Ptr parent,cte_Ptr slot);;
(Guard ArrayBounds (if base >> local.asid_low_bits < 0x80 then UNIV else {}) (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) (ap_Ptr frame))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) (?d'1592 asid_base parenta slota framea rv' pcap rv'a)
 3. \<And>asid_base parenta slota framea rv' pcap y rv'a. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1592 asid_base parenta slota framea rv' pcap y) (?Q'1592 asid_base parenta slota framea rv' pcap y rv'a) [SKIP] (do y <- placeNewObject frame makeObject 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot;
y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (\<lambda>a. armKSASIDTable (ksArchState a));
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) (?d'1592 asid_base parenta slota framea rv' pcap rv'a)
 4. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>?Q1592 asid_base parenta slota framea rv' pcap\<rbrace>
 5. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1592 asid_base parenta slota framea rv' pcap y (xfdc s)}
 6. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 8. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 9. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 10. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and ?R1600 asid_base parenta slota framea y (xfdc s) rv and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> ?R'1594 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
A total of 11 subgoals...
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (11 subgoals):
 1. \<And>s cte cte' t ta cap. \<lbrakk>is_aligned (cap_C.words_C (cte_C.cap_C cte').[0] && ~~ mask 4) 12; base \<le> mask local.asid_bits; is_aligned base local.asid_low_bits; cslift s (cte_Ptr parent) = Some cte'; cteCap cte = capability.UntypedCap (to_bool ((cap_C.words_C (cte_C.cap_C cte').[Suc 0] >> 5) && 1)) (cap_C.words_C (cte_C.cap_C cte').[0] && ~~ mask 4) 12 (unat ((cap_C.words_C (cte_C.cap_C cte').[Suc 0] >> 6) && mask 26 << 4)); ccte_relation cte cte'; cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; isdev = to_bool ((cap_C.words_C (cte_C.cap_C cte').[Suc 0] >> 5) && 1); frame = cap_C.words_C (cte_C.cap_C cte').[0] && ~~ mask 4; idx = unat ((cap_C.words_C (cte_C.cap_C cte').[Suc 0] >> 6) && mask 26 << 4); cap_C.words_C (cte_C.cap_C cte').[Suc 0] && mask 5 = 0xC; ret__unsigned_' t = 0xC; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals s)); (cap_C.words_C cap.[Suc 0] >> 6) && mask 26 = 0x100 && mask 26; (cap_C.words_C cap.[Suc 0] >> 5) && 1 = (cap_C.words_C (cte_C.cap_C cte').[Suc 0] >> 5) && 1; cap_C.words_C cap.[Suc 0] && mask 5 = 0xC; cap_C.words_C cap.[0] && ~~ mask 4 = cap_C.words_C (cte_C.cap_C cte').[0] && ~~ mask 4\<rbrakk> \<Longrightarrow> \<exists>capa. (case cap_lift capa of Some (Cap_untyped_cap rec) \<Rightarrow> rec) = \<lparr>capFreeIndex_CL = word_of_nat (max_free_index 12) >> 4, capIsDevice_CL = (cap_C.words_C (cte_C.cap_C cte').[Suc 0] >> 5) && 1, capBlockSize_CL = 0xC, capPtr_CL = cap_C.words_C (cte_C.cap_C cte').[0] && ~~ mask 4\<rparr> \<and> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals s)) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. capa) cte')) (t_hrs_' (globals s)) \<and> globals s may_only_modify_globals s in [t_hrs]
 2. \<And>asid_base parenta slota framea rv' pcap rv'a t t'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (Guard ShiftError (if 0 \<le>s ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) (CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits)));;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame))));;
(\<acute>ret__struct_cap_C :== CALL cap_asid_pool_cap_new_'proc(base,frame);;
(CALL cteInsert_'proc(\<acute>ret__struct_cap_C,cte_Ptr parent,cte_Ptr slot);;
(Guard ArrayBounds (if base >> local.asid_low_bits < 0x80 then UNIV else {}) (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) (ap_Ptr frame))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) (?d'1592 asid_base parenta slota framea rv' pcap rv'a)
 3. \<And>asid_base parenta slota framea rv' pcap y rv'a. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1592 asid_base parenta slota framea rv' pcap y) (?Q'1592 asid_base parenta slota framea rv' pcap y rv'a) [SKIP] (do y <- placeNewObject frame makeObject 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot;
y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (\<lambda>a. armKSASIDTable (ksArchState a));
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) (?d'1592 asid_base parenta slota framea rv' pcap rv'a)
 4. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>?Q1592 asid_base parenta slota framea rv' pcap\<rbrace>
 5. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1592 asid_base parenta slota framea rv' pcap y (xfdc s)}
 6. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 8. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 9. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 10. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and ?R1600 asid_base parenta slota framea y (xfdc s) rv and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> ?R'1594 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
A total of 11 subgoals...
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (11 subgoals):
 1. \<And>s cte cte' t ta cap. \<lbrakk>is_aligned (cap_C.words_C (cte_C.cap_C cte').[0] && ~~ mask 4) 12; base \<le> mask local.asid_bits; is_aligned base local.asid_low_bits; cslift s (cte_Ptr parent) = Some cte'; cteCap cte = capability.UntypedCap (to_bool ((cap_C.words_C (cte_C.cap_C cte').[Suc 0] >> 5) && 1)) (cap_C.words_C (cte_C.cap_C cte').[0] && ~~ mask 4) 12 (unat ((cap_C.words_C (cte_C.cap_C cte').[Suc 0] >> 6) && mask 26 << 4)); ccte_relation cte cte'; cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; isdev = to_bool ((cap_C.words_C (cte_C.cap_C cte').[Suc 0] >> 5) && 1); frame = cap_C.words_C (cte_C.cap_C cte').[0] && ~~ mask 4; idx = unat ((cap_C.words_C (cte_C.cap_C cte').[Suc 0] >> 6) && mask 26 << 4); cap_C.words_C (cte_C.cap_C cte').[Suc 0] && mask 5 = 0xC; ret__unsigned_' t = 0xC; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals s)); (cap_C.words_C cap.[Suc 0] >> 6) && mask 26 = 0x100 && mask 26; (cap_C.words_C cap.[Suc 0] >> 5) && 1 = (cap_C.words_C (cte_C.cap_C cte').[Suc 0] >> 5) && 1; cap_C.words_C cap.[Suc 0] && mask 5 = 0xC; cap_C.words_C cap.[0] && ~~ mask 4 = cap_C.words_C (cte_C.cap_C cte').[0] && ~~ mask 4\<rbrakk> \<Longrightarrow> (case cap_lift cap of Some (Cap_untyped_cap rec) \<Rightarrow> rec) = \<lparr>capFreeIndex_CL = word_of_nat (max_free_index 12) >> 4, capIsDevice_CL = (cap_C.words_C (cte_C.cap_C cte').[Suc 0] >> 5) && 1, capBlockSize_CL = 0xC, capPtr_CL = cap_C.words_C (cte_C.cap_C cte').[0] && ~~ mask 4\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> True \<and> globals s may_only_modify_globals s in [t_hrs]
 2. \<And>asid_base parenta slota framea rv' pcap rv'a t t'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (Guard ShiftError (if 0 \<le>s ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) (CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits)));;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame))));;
(\<acute>ret__struct_cap_C :== CALL cap_asid_pool_cap_new_'proc(base,frame);;
(CALL cteInsert_'proc(\<acute>ret__struct_cap_C,cte_Ptr parent,cte_Ptr slot);;
(Guard ArrayBounds (if base >> local.asid_low_bits < 0x80 then UNIV else {}) (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) (ap_Ptr frame))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) (?d'1592 asid_base parenta slota framea rv' pcap rv'a)
 3. \<And>asid_base parenta slota framea rv' pcap y rv'a. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1592 asid_base parenta slota framea rv' pcap y) (?Q'1592 asid_base parenta slota framea rv' pcap y rv'a) [SKIP] (do y <- placeNewObject frame makeObject 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot;
y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (\<lambda>a. armKSASIDTable (ksArchState a));
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) (?d'1592 asid_base parenta slota framea rv' pcap rv'a)
 4. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>?Q1592 asid_base parenta slota framea rv' pcap\<rbrace>
 5. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1592 asid_base parenta slota framea rv' pcap y (xfdc s)}
 6. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 8. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 9. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 10. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and ?R1600 asid_base parenta slota framea y (xfdc s) rv and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> ?R'1594 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
A total of 11 subgoals...
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (11 subgoals):
 1. \<And>s cte cte' t ta cap x1 x2. \<lbrakk>is_aligned (cap_C.words_C x1.[0] && 0xFFFFFFF0) 12; base < 2 ^ local.asid_bits; is_aligned base local.asid_low_bits; cslift s (cte_Ptr parent) = Some (cte_C x1 x2); cteCap cte = capability.UntypedCap (to_bool ((cap_C.words_C x1.[Suc 0] >> 5) && 1)) (cap_C.words_C x1.[0] && 0xFFFFFFF0) 12 (unat ((cap_C.words_C x1.[Suc 0] >> 6) && 0x3FFFFFF << 4)); ccte_relation cte (cte_C x1 x2); cap_get_tag x1 = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; isdev = to_bool ((cap_C.words_C x1.[Suc 0] >> 5) && 1); frame = cap_C.words_C x1.[0] && 0xFFFFFFF0; idx = unat ((cap_C.words_C x1.[Suc 0] >> 6) && 0x3FFFFFF << 4); cap_C.words_C x1.[Suc 0] && 0x1F = 0xC; ret__unsigned_' t = 0xC; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C cap x2)) (t_hrs_' (globals s)); (cap_C.words_C cap.[Suc 0] >> 6) && 0x3FFFFFF = 0x100; (cap_C.words_C cap.[Suc 0] >> 5) && 1 = (cap_C.words_C x1.[Suc 0] >> 5) && 1; cap_C.words_C cap.[Suc 0] && 0x1F = 0xC; cap_C.words_C cap.[0] && 0xFFFFFFF0 = cap_C.words_C x1.[0] && 0xFFFFFFF0; cte' = cte_C x1 x2\<rbrakk> \<Longrightarrow> globals s may_only_modify_globals s in [t_hrs]
 2. \<And>asid_base parenta slota framea rv' pcap rv'a t t'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (Guard ShiftError (if 0 \<le>s ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) (CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits)));;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame))));;
(\<acute>ret__struct_cap_C :== CALL cap_asid_pool_cap_new_'proc(base,frame);;
(CALL cteInsert_'proc(\<acute>ret__struct_cap_C,cte_Ptr parent,cte_Ptr slot);;
(Guard ArrayBounds (if base >> local.asid_low_bits < 0x80 then UNIV else {}) (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) (ap_Ptr frame))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) (?d'1592 asid_base parenta slota framea rv' pcap rv'a)
 3. \<And>asid_base parenta slota framea rv' pcap y rv'a. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1592 asid_base parenta slota framea rv' pcap y) (?Q'1592 asid_base parenta slota framea rv' pcap y rv'a) [SKIP] (do y <- placeNewObject frame makeObject 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot;
y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (\<lambda>a. armKSASIDTable (ksArchState a));
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) (?d'1592 asid_base parenta slota framea rv' pcap rv'a)
 4. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>?Q1592 asid_base parenta slota framea rv' pcap\<rbrace>
 5. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1592 asid_base parenta slota framea rv' pcap y (xfdc s)}
 6. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 8. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 9. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 10. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and ?R1600 asid_base parenta slota framea y (xfdc s) rv and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> ?R'1594 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
A total of 11 subgoals...
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (11 subgoals):
 1. \<And>s cte cte' t ta cap x1 x2. \<lbrakk>is_aligned (cap_C.words_C x1.[0] && 0xFFFFFFF0) 12; base < 2 ^ local.asid_bits; is_aligned base local.asid_low_bits; cslift s (cte_Ptr parent) = Some (cte_C x1 x2); cteCap cte = capability.UntypedCap (to_bool ((cap_C.words_C x1.[Suc 0] >> 5) && 1)) (cap_C.words_C x1.[0] && 0xFFFFFFF0) 12 (unat ((cap_C.words_C x1.[Suc 0] >> 6) && 0x3FFFFFF << 4)); ccte_relation cte (cte_C x1 x2); cap_get_tag x1 = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; isdev = to_bool ((cap_C.words_C x1.[Suc 0] >> 5) && 1); frame = cap_C.words_C x1.[0] && 0xFFFFFFF0; idx = unat ((cap_C.words_C x1.[Suc 0] >> 6) && 0x3FFFFFF << 4); cap_C.words_C x1.[Suc 0] && 0x1F = 0xC; ret__unsigned_' t = 0xC; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C cap x2)) (t_hrs_' (globals s)); (cap_C.words_C cap.[Suc 0] >> 6) && 0x3FFFFFF = 0x100; (cap_C.words_C cap.[Suc 0] >> 5) && 1 = (cap_C.words_C x1.[Suc 0] >> 5) && 1; cap_C.words_C cap.[Suc 0] && 0x1F = 0xC; cap_C.words_C cap.[0] && 0xFFFFFFF0 = cap_C.words_C x1.[0] && 0xFFFFFFF0; cte' = cte_C x1 x2\<rbrakk> \<Longrightarrow> \<exists>t_hrs_'a. globals s\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr parent) (cte_C cap x2)) (t_hrs_' (globals s))\<rparr> = globals s\<lparr>t_hrs_' := t_hrs_'a\<rparr>
 2. \<And>asid_base parenta slota framea rv' pcap rv'a t t'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (Guard ShiftError (if 0 \<le>s ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) (CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits)));;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame))));;
(\<acute>ret__struct_cap_C :== CALL cap_asid_pool_cap_new_'proc(base,frame);;
(CALL cteInsert_'proc(\<acute>ret__struct_cap_C,cte_Ptr parent,cte_Ptr slot);;
(Guard ArrayBounds (if base >> local.asid_low_bits < 0x80 then UNIV else {}) (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) (ap_Ptr frame))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) (?d'1592 asid_base parenta slota framea rv' pcap rv'a)
 3. \<And>asid_base parenta slota framea rv' pcap y rv'a. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1592 asid_base parenta slota framea rv' pcap y) (?Q'1592 asid_base parenta slota framea rv' pcap y rv'a) [SKIP] (do y <- placeNewObject frame makeObject 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot;
y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (\<lambda>a. armKSASIDTable (ksArchState a));
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) (?d'1592 asid_base parenta slota framea rv' pcap rv'a)
 4. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>?Q1592 asid_base parenta slota framea rv' pcap\<rbrace>
 5. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1592 asid_base parenta slota framea rv' pcap y (xfdc s)}
 6. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 8. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 9. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 10. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and ?R1600 asid_base parenta slota framea y (xfdc s) rv and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> ?R'1594 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
A total of 11 subgoals...
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (10 subgoals):
 1. \<And>asid_base parenta slota framea rv' pcap rv'a t t'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (Guard ShiftError (if 0 \<le>s ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) (CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits)));;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame))));;
(\<acute>ret__struct_cap_C :== CALL cap_asid_pool_cap_new_'proc(base,frame);;
(CALL cteInsert_'proc(\<acute>ret__struct_cap_C,cte_Ptr parent,cte_Ptr slot);;
(Guard ArrayBounds (if base >> local.asid_low_bits < 0x80 then UNIV else {}) (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) (ap_Ptr frame))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))) (?d'1592 asid_base parenta slota framea rv' pcap rv'a)
 2. \<And>asid_base parenta slota framea rv' pcap y rv'a. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1592 asid_base parenta slota framea rv' pcap y) (?Q'1592 asid_base parenta slota framea rv' pcap y rv'a) [SKIP] (do y <- placeNewObject frame makeObject 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot;
y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (\<lambda>a. armKSASIDTable (ksArchState a));
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) (?d'1592 asid_base parenta slota framea rv' pcap rv'a)
 3. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>?Q1592 asid_base parenta slota framea rv' pcap\<rbrace>
 4. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1592 asid_base parenta slota framea rv' pcap y (xfdc s)}
 5. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 7. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 8. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 9. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and ?R1600 asid_base parenta slota framea y (xfdc s) rv and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> ?R'1594 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 10. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (9 subgoals):
 1. \<And>asid_base parenta slota framea rv' pcap y rv'a. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1592 asid_base parenta slota framea rv' pcap y) (?Q'1592 asid_base parenta slota framea rv' pcap y rv'a) [SKIP] (do y <- placeNewObject frame makeObject 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot;
y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (\<lambda>a. armKSASIDTable (ksArchState a));
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) (Guard ShiftError (if 0 \<le>s ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) (CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits)));;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame))));;
(\<acute>ret__struct_cap_C :== CALL cap_asid_pool_cap_new_'proc(base,frame);;
(CALL cteInsert_'proc(\<acute>ret__struct_cap_C,cte_Ptr parent,cte_Ptr slot);;
(Guard ArrayBounds (if base >> local.asid_low_bits < 0x80 then UNIV else {}) (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>globals :== armKSASIDTable_'_update (\<lambda>_. Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) (ap_Ptr frame)))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>?Q1592 asid_base parenta slota framea rv' pcap\<rbrace>
 3. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'1592 asid_base parenta slota framea rv' pcap y (xfdc s)}
 4. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 6. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 7. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 8. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and ?R1600 asid_base parenta slota framea y (xfdc s) rv and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> ?R'1594 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 9. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (9 subgoals):
 1. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1592 asid_base parenta slota framea rv' pcap y) (?G'1871 asid_base parenta slota framea rv' pcap y rv'a rv'b) [SKIP] (do y <- placeNewObject frame makeObject 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot;
y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (\<lambda>a. armKSASIDTable (ksArchState a));
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) (Guard ShiftError (if 0 \<le>s ARMSmallPageBits then UNIV else {}) (Guard ShiftError (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) (CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits)));;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame))));;
(\<acute>ret__struct_cap_C :== CALL cap_asid_pool_cap_new_'proc(base,frame);;
(CALL cteInsert_'proc(\<acute>ret__struct_cap_C,cte_Ptr parent,cte_Ptr slot);;
(Guard ArrayBounds (if base >> local.asid_low_bits < 0x80 then UNIV else {}) (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) (ap_Ptr frame))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>?Q1592 asid_base parenta slota framea rv' pcap\<rbrace>
 3. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?G'1871 asid_base parenta slota framea rv' pcap y (xfdc s) ()}}
 4. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 6. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 7. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 8. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and ?R1600 asid_base parenta slota framea y (xfdc s) rv and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> ?R'1594 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 9. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (9 subgoals):
 1. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1592 asid_base parenta slota framea rv' pcap y) (?C'1948 asid_base parenta slota framea rv' pcap y rv'a rv'b) [SKIP] (do y <- placeNewObject frame makeObject 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot;
y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (\<lambda>a. armKSASIDTable (ksArchState a));
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) (CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits);;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame))));;
(\<acute>ret__struct_cap_C :== CALL cap_asid_pool_cap_new_'proc(base,frame);;
(CALL cteInsert_'proc(\<acute>ret__struct_cap_C,cte_Ptr parent,cte_Ptr slot);;
(Guard ArrayBounds (if base >> local.asid_low_bits < 0x80 then UNIV else {}) (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) (ap_Ptr frame))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>?Q1592 asid_base parenta slota framea rv' pcap\<rbrace>
 3. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?C'1948 asid_base parenta slota framea rv' pcap y (xfdc s) () \<inter> (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) \<inter> (if 0 \<le>s ARMSmallPageBits then UNIV else {})}}
 4. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 6. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 7. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 8. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and ?R1600 asid_base parenta slota framea y (xfdc s) rv and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> ?R'1594 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 9. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (11 subgoals):
 1. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b rv xfdc. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1956 asid_base parenta slota framea rv' pcap y rv'a rv'b rv) (?Q'1956 asid_base parenta slota framea rv' pcap y rv'a rv'b rv xfdc) [SKIP] (do y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot;
y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (\<lambda>a. armKSASIDTable (ksArchState a));
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) (\<acute>ret__struct_cap_C :== CALL cap_asid_pool_cap_new_'proc(base,frame);;
(CALL cteInsert_'proc(\<acute>ret__struct_cap_C,cte_Ptr parent,cte_Ptr slot);;
(Guard ArrayBounds (if base >> local.asid_low_bits < 0x80 then UNIV else {}) (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) (ap_Ptr frame))));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1961 asid_base parenta slota framea rv' pcap y\<rbrace> placeNewObject frame makeObject 0 \<lbrace>?Q1956 asid_base parenta slota framea rv' pcap y rv'a rv'b\<rbrace>
 3. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1956 asid_base parenta slota framea rv' pcap y rv'a rv'b) CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1956 asid_base parenta slota framea rv' pcap y rv'a rv'b rv (xfdc s)}
 4. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>\<lambda>a. (\<lambda>s. \<exists>p. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?isdev1967 asid_base parenta slota framea rv' pcap a) frame pageBits (max_free_index pageBits)) p s) and pspace_aligned' and pspace_distinct' and valid_objs' and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {frame..+2 ^ pageBits}) and valid_global_refs' and pspace_no_overlap' frame pageBits and ?R1961 asid_base parenta slota framea rv' pcap a\<rbrace>
 5. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s. region_actually_is_bytes frame (2 ^ pageBits) s} \<inter> ?R'1956 asid_base parenta slota framea rv' pcap y (xfdc s) () \<inter> (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) \<inter> (if 0 \<le>s ARMSmallPageBits then UNIV else {})}}
 6. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 8. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 9. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 10. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and ?R1600 asid_base parenta slota framea y (xfdc s) rv and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> ?R'1594 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
A total of 11 subgoals...
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (11 subgoals):
 1. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b rv xfdc ret__struct_cap_C. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a; dc rv xfdc; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1956 asid_base parenta slota framea rv' pcap y rv'a rv'b rv) (?G'2003 asid_base parenta slota framea rv' pcap y rv'a rv'b rv xfdc ret__struct_cap_C) [SKIP] (do y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot;
y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (\<lambda>a. armKSASIDTable (ksArchState a));
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) (CALL cteInsert_'proc(ret__struct_cap_C,cte_Ptr parent,cte_Ptr slot);;
(Guard ArrayBounds (if base >> local.asid_low_bits < 0x80 then UNIV else {}) (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) (ap_Ptr frame))));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1961 asid_base parenta slota framea rv' pcap y\<rbrace> placeNewObject frame makeObject 0 \<lbrace>?Q1956 asid_base parenta slota framea rv' pcap y rv'a rv'b\<rbrace>
 3. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1956 asid_base parenta slota framea rv' pcap y rv'a rv'b) CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = capASIDBase_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) sa)) && mask 17, capASIDPool_CL = capASIDPool_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) sa)) && ~~ mask 4\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> ?G'2003 asid_base parenta slota framea rv' pcap y rv'a rv'b rv (xfdc s) v}}
 4. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>\<lambda>a. (\<lambda>s. \<exists>p. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?isdev1967 asid_base parenta slota framea rv' pcap a) frame pageBits (max_free_index pageBits)) p s) and pspace_aligned' and pspace_distinct' and valid_objs' and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {frame..+2 ^ pageBits}) and valid_global_refs' and pspace_no_overlap' frame pageBits and ?R1961 asid_base parenta slota framea rv' pcap a\<rbrace>
 5. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s. region_actually_is_bytes frame (2 ^ pageBits) s} \<inter> ?R'1956 asid_base parenta slota framea rv' pcap y (xfdc s) () \<inter> (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) \<inter> (if 0 \<le>s ARMSmallPageBits then UNIV else {})}}
 6. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 8. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 9. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 10. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and ?R1600 asid_base parenta slota framea y (xfdc s) rv and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> ?R'1594 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
A total of 11 subgoals...
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (12 subgoals):
 1. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b rv xfdca ret__struct_cap_C rva xfdc. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a; dc rv xfdca; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap; dc rva xfdc\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2141 asid_base parenta slota framea rv' pcap y rv'a rv'b rv xfdca ret__struct_cap_C rva) (?Q'2141 asid_base parenta slota framea rv' pcap y rv'a rv'b rv xfdca ret__struct_cap_C rva xfdc) [SKIP] (do y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (\<lambda>a. armKSASIDTable (ksArchState a));
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) (Guard ArrayBounds (if base >> local.asid_low_bits < 0x80 then UNIV else {}) (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) (ap_Ptr frame))));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b rv xfdc ret__struct_cap_C. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a; dc rv xfdc; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b rv\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot \<lbrace>?Q2141 asid_base parenta slota framea rv' pcap y rv'a rv'b rv xfdc ret__struct_cap_C\<rbrace>
 3. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1961 asid_base parenta slota framea rv' pcap y\<rbrace> placeNewObject frame makeObject 0 \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<or> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base))) parent and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) and cte_wp_at' (\<lambda>c. True) parent and ?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b a\<rbrace>
 4. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1956 asid_base parenta slota framea rv' pcap y rv'a rv'b) CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = capASIDBase_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) sa)) && mask 17, capASIDPool_CL = capASIDPool_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) sa)) && ~~ mask 4\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. destSlot_'_update (\<lambda>_. cte_Ptr slot) (srcSlot_'_update (\<lambda>_. cte_Ptr parent) (newCap_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'2141 asid_base parenta slota framea rv' pcap y rv'a rv'b rv (xfdc s) v rva (xfdc t)}}}
 5. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>\<lambda>a. (\<lambda>s. \<exists>p. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?isdev1967 asid_base parenta slota framea rv' pcap a) frame pageBits (max_free_index pageBits)) p s) and pspace_aligned' and pspace_distinct' and valid_objs' and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {frame..+2 ^ pageBits}) and valid_global_refs' and pspace_no_overlap' frame pageBits and ?R1961 asid_base parenta slota framea rv' pcap a\<rbrace>
 6. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s. region_actually_is_bytes frame (2 ^ pageBits) s} \<inter> ?R'1956 asid_base parenta slota framea rv' pcap y (xfdc s) () \<inter> (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) \<inter> (if 0 \<le>s ARMSmallPageBits then UNIV else {})}}
 7. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 9. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 10. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (12 subgoals):
 1. \<And>asid_base parenta slota framea rv' pcap rv'a xfdca ret__struct_cap_C xfdc. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2141 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) rv' (capability.UntypedCap isdev frame pageBits idx) () rv'a () () xfdca ret__struct_cap_C ()) (?Q'2141 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) rv' (capability.UntypedCap isdev frame pageBits idx) () rv'a () () xfdca ret__struct_cap_C () xfdc) [SKIP] (do y <- assert (base && mask local.asid_low_bits = 0);
asidTable <- gets (\<lambda>a. armKSASIDTable (ksArchState a));
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) (Guard ArrayBounds (if base >> local.asid_low_bits < 0x80 then UNIV else {}) (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) (ap_Ptr frame))));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b rv xfdc ret__struct_cap_C. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a; dc rv xfdc; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b rv\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot \<lbrace>?Q2141 asid_base parenta slota framea rv' pcap y rv'a rv'b rv xfdc ret__struct_cap_C\<rbrace>
 3. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1961 asid_base parenta slota framea rv' pcap y\<rbrace> placeNewObject frame makeObject 0 \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<or> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base))) parent and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) and cte_wp_at' (\<lambda>c. True) parent and ?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b a\<rbrace>
 4. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1956 asid_base parenta slota framea rv' pcap y rv'a rv'b) CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = capASIDBase_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) sa)) && mask 17, capASIDPool_CL = capASIDPool_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) sa)) && ~~ mask 4\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. destSlot_'_update (\<lambda>_. cte_Ptr slot) (srcSlot_'_update (\<lambda>_. cte_Ptr parent) (newCap_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'2141 asid_base parenta slota framea rv' pcap y rv'a rv'b rv (xfdc s) v rva (xfdc t)}}}
 5. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>\<lambda>a. (\<lambda>s. \<exists>p. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?isdev1967 asid_base parenta slota framea rv' pcap a) frame pageBits (max_free_index pageBits)) p s) and pspace_aligned' and pspace_distinct' and valid_objs' and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {frame..+2 ^ pageBits}) and valid_global_refs' and pspace_no_overlap' frame pageBits and ?R1961 asid_base parenta slota framea rv' pcap a\<rbrace>
 6. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s. region_actually_is_bytes frame (2 ^ pageBits) s} \<inter> ?R'1956 asid_base parenta slota framea rv' pcap y (xfdc s) () \<inter> (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) \<inter> (if 0 \<le>s ARMSmallPageBits then UNIV else {})}}
 7. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 9. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 10. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (12 subgoals):
 1. \<And>asid_base parenta slota framea rv' pcap rv'a xfdca ret__struct_cap_C xfdc. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap; base && mask local.asid_low_bits = 0\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2141 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) rv' (capability.UntypedCap isdev frame pageBits idx) () rv'a () () xfdca ret__struct_cap_C ()) (?Q'2141 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) rv' (capability.UntypedCap isdev frame pageBits idx) () rv'a () () xfdca ret__struct_cap_C () xfdc) [SKIP] (do asidTable <- gets (\<lambda>a. armKSASIDTable (ksArchState a));
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) (Guard ArrayBounds (if base >> local.asid_low_bits < 0x80 then UNIV else {}) (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) (ap_Ptr frame))));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b rv xfdc ret__struct_cap_C. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a; dc rv xfdc; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b rv\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot \<lbrace>?Q2141 asid_base parenta slota framea rv' pcap y rv'a rv'b rv xfdc ret__struct_cap_C\<rbrace>
 3. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1961 asid_base parenta slota framea rv' pcap y\<rbrace> placeNewObject frame makeObject 0 \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<or> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base))) parent and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) and cte_wp_at' (\<lambda>c. True) parent and ?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b a\<rbrace>
 4. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1956 asid_base parenta slota framea rv' pcap y rv'a rv'b) CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = capASIDBase_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) sa)) && mask 17, capASIDPool_CL = capASIDPool_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) sa)) && ~~ mask 4\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> sa\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. destSlot_'_update (\<lambda>_. cte_Ptr slot) (srcSlot_'_update (\<lambda>_. cte_Ptr parent) (newCap_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace>} \<inter> {s'. \<forall>t rva. dc rva (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'2141 asid_base parenta slota framea rv' pcap y rv'a rv'b rv (xfdc s) v rva (xfdc t)}}}
 5. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>\<lambda>a. (\<lambda>s. \<exists>p. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?isdev1967 asid_base parenta slota framea rv' pcap a) frame pageBits (max_free_index pageBits)) p s) and pspace_aligned' and pspace_distinct' and valid_objs' and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {frame..+2 ^ pageBits}) and valid_global_refs' and pspace_no_overlap' frame pageBits and ?R1961 asid_base parenta slota framea rv' pcap a\<rbrace>
 6. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s. region_actually_is_bytes frame (2 ^ pageBits) s} \<inter> ?R'1956 asid_base parenta slota framea rv' pcap y (xfdc s) () \<inter> (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) \<inter> (if 0 \<le>s ARMSmallPageBits then UNIV else {})}}
 7. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 9. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 10. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (12 subgoals):
 1. \<And>asid_base parenta slota framea rv' pcap rv'a xfdca ret__struct_cap_C xfdc. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap; base && mask local.asid_low_bits = 0\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} Guard ArrayBounds (if base >> local.asid_low_bits < 0x80 then UNIV else {}) (Guard ShiftError (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) (Guard ShiftError (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) (\<acute>armKSASIDTable :== Arrays.update \<acute>armKSASIDTable (unat (base >> local.asid_low_bits)) (ap_Ptr frame))));;
return_C ret__unsigned_long_'_update (\<lambda>a. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) {},{s. \<exists>(rv, \<sigma>')\<in>fst ((do asidTable <- gets (\<lambda>a. armKSASIDTable (ksArchState a));
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b rv xfdc ret__struct_cap_C. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a; dc rv xfdc; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b rv\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1961 asid_base parenta slota framea rv' pcap y\<rbrace> placeNewObject frame makeObject 0 \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<or> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base))) parent and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) and cte_wp_at' (\<lambda>c. True) parent and ?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b a\<rbrace>
 4. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1956 asid_base parenta slota framea rv' pcap y rv'a rv'b) CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = capASIDBase_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && mask 17, capASIDPool_CL = capASIDPool_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && ~~ mask 4\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. destSlot_'_update (\<lambda>_. cte_Ptr slot) (srcSlot_'_update (\<lambda>_. cte_Ptr parent) (newCap_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}
 5. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>\<lambda>a. (\<lambda>s. \<exists>p. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?isdev1967 asid_base parenta slota framea rv' pcap a) frame pageBits (max_free_index pageBits)) p s) and pspace_aligned' and pspace_distinct' and valid_objs' and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {frame..+2 ^ pageBits}) and valid_global_refs' and pspace_no_overlap' frame pageBits and ?R1961 asid_base parenta slota framea rv' pcap a\<rbrace>
 6. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s. region_actually_is_bytes frame (2 ^ pageBits) s} \<inter> ?R'1956 asid_base parenta slota framea rv' pcap y (xfdc s) () \<inter> (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) \<inter> (if 0 \<le>s ARMSmallPageBits then UNIV else {})}}
 7. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 9. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 10. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (12 subgoals):
 1. \<And>asid_base parenta slota framea rv' pcap rv'a xfdca ret__struct_cap_C xfdc \<sigma>. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap; base && mask local.asid_low_bits = 0\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> (if base >> local.asid_low_bits < 0x80 then UNIV else {}) \<inter> ((if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) \<inter> ((if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) \<inter> {s. \<exists>(rv, \<sigma>')\<in>fst ((do asidTable <- gets (\<lambda>a. armKSASIDTable (ksArchState a));
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState s)\<rparr>)
od) \<sigma>). (\<sigma>', globals_update (armKSASIDTable_'_update (\<lambda>_. Arrays.update (armKSASIDTable_' (globals s)) (unat (base >> local.asid_low_bits)) (ap_Ptr frame))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (K (K (\<lambda>_. False)) \<currency> dc) (Inr rv) (liftxf errstate id (K ()) ret__unsigned_long_' (globals_update (armKSASIDTable_'_update (\<lambda>_. Arrays.update (armKSASIDTable_' (globals s)) (unat (base >> local.asid_low_bits)) (ap_Ptr frame))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>))}))
 2. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b rv xfdc ret__struct_cap_C. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a; dc rv xfdc; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b rv\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1961 asid_base parenta slota framea rv' pcap y\<rbrace> placeNewObject frame makeObject 0 \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<or> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base))) parent and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) and cte_wp_at' (\<lambda>c. True) parent and ?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b a\<rbrace>
 4. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1956 asid_base parenta slota framea rv' pcap y rv'a rv'b) CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = capASIDBase_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && mask 17, capASIDPool_CL = capASIDPool_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && ~~ mask 4\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. destSlot_'_update (\<lambda>_. cte_Ptr slot) (srcSlot_'_update (\<lambda>_. cte_Ptr parent) (newCap_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}
 5. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>\<lambda>a. (\<lambda>s. \<exists>p. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?isdev1967 asid_base parenta slota framea rv' pcap a) frame pageBits (max_free_index pageBits)) p s) and pspace_aligned' and pspace_distinct' and valid_objs' and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {frame..+2 ^ pageBits}) and valid_global_refs' and pspace_no_overlap' frame pageBits and ?R1961 asid_base parenta slota framea rv' pcap a\<rbrace>
 6. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s. region_actually_is_bytes frame (2 ^ pageBits) s} \<inter> ?R'1956 asid_base parenta slota framea rv' pcap y (xfdc s) () \<inter> (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) \<inter> (if 0 \<le>s ARMSmallPageBits then UNIV else {})}}
 7. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 9. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 10. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (12 subgoals):
 1. \<And>ret__struct_cap_C \<sigma>. \<lbrakk>is_aligned frame pageBits; base && mask local.asid_low_bits = 0; base \<le> mask local.asid_bits; is_aligned base local.asid_low_bits; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr>; cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap\<rbrakk> \<Longrightarrow> {s. (\<sigma>, s) \<in> rf_sr} \<subseteq> (if 0 \<le>s Kernel_C.asidLowBits then UNIV else {}) \<and> {s. (\<sigma>, s) \<in> rf_sr} \<subseteq> (if Kernel_C.asidLowBits <s 0x20 then UNIV else {}) \<and> {s. (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (\<sigma>\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. (armKSASIDTable (ksArchState \<sigma>))(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState \<sigma>)\<rparr>, globals_update (armKSASIDTable_'_update (\<lambda>_. Arrays.update (armKSASIDTable_' (globals s)) (unat (base >> local.asid_low_bits)) (ap_Ptr frame))) s) \<in> rf_sr}
 2. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b rv xfdc ret__struct_cap_C. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a; dc rv xfdc; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b rv\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1961 asid_base parenta slota framea rv' pcap y\<rbrace> placeNewObject frame makeObject 0 \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<or> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base))) parent and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) and cte_wp_at' (\<lambda>c. True) parent and ?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b a\<rbrace>
 4. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1956 asid_base parenta slota framea rv' pcap y rv'a rv'b) CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = capASIDBase_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && mask 17, capASIDPool_CL = capASIDPool_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && ~~ mask 4\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. destSlot_'_update (\<lambda>_. cte_Ptr slot) (srcSlot_'_update (\<lambda>_. cte_Ptr parent) (newCap_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}
 5. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>\<lambda>a. (\<lambda>s. \<exists>p. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?isdev1967 asid_base parenta slota framea rv' pcap a) frame pageBits (max_free_index pageBits)) p s) and pspace_aligned' and pspace_distinct' and valid_objs' and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {frame..+2 ^ pageBits}) and valid_global_refs' and pspace_no_overlap' frame pageBits and ?R1961 asid_base parenta slota framea rv' pcap a\<rbrace>
 6. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s. region_actually_is_bytes frame (2 ^ pageBits) s} \<inter> ?R'1956 asid_base parenta slota framea rv' pcap y (xfdc s) () \<inter> (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) \<inter> (if 0 \<le>s ARMSmallPageBits then UNIV else {})}}
 7. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 9. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 10. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (12 subgoals):
 1. \<And>ret__struct_cap_C \<sigma> x. \<lbrakk>is_aligned frame pageBits; base && mask local.asid_low_bits = 0; base \<le> mask local.asid_bits; is_aligned base local.asid_low_bits; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr>; cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> (\<sigma>\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. (armKSASIDTable (ksArchState \<sigma>))(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState \<sigma>)\<rparr>, globals_update (armKSASIDTable_'_update (\<lambda>_. Arrays.update (armKSASIDTable_' (globals x)) (unat (base >> local.asid_low_bits)) (ap_Ptr frame))) x) \<in> rf_sr
 2. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b rv xfdc ret__struct_cap_C. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a; dc rv xfdc; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b rv\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1961 asid_base parenta slota framea rv' pcap y\<rbrace> placeNewObject frame makeObject 0 \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<or> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base))) parent and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) and cte_wp_at' (\<lambda>c. True) parent and ?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b a\<rbrace>
 4. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1956 asid_base parenta slota framea rv' pcap y rv'a rv'b) CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = capASIDBase_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && mask 17, capASIDPool_CL = capASIDPool_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && ~~ mask 4\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. destSlot_'_update (\<lambda>_. cte_Ptr slot) (srcSlot_'_update (\<lambda>_. cte_Ptr parent) (newCap_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}
 5. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>\<lambda>a. (\<lambda>s. \<exists>p. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?isdev1967 asid_base parenta slota framea rv' pcap a) frame pageBits (max_free_index pageBits)) p s) and pspace_aligned' and pspace_distinct' and valid_objs' and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {frame..+2 ^ pageBits}) and valid_global_refs' and pspace_no_overlap' frame pageBits and ?R1961 asid_base parenta slota framea rv' pcap a\<rbrace>
 6. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s. region_actually_is_bytes frame (2 ^ pageBits) s} \<inter> ?R'1956 asid_base parenta slota framea rv' pcap y (xfdc s) () \<inter> (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) \<inter> (if 0 \<le>s ARMSmallPageBits then UNIV else {})}}
 7. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 9. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 10. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (12 subgoals):
 1. \<And>ret__struct_cap_C \<sigma> x. \<lbrakk>is_aligned frame pageBits; base && mask local.asid_low_bits = 0; base \<le> mask local.asid_bits; is_aligned base local.asid_low_bits; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr>; cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (armKSASIDTable_update (\<lambda>_. (armKSASIDTable (ksArchState \<sigma>))(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (ksArchState \<sigma>)) (globals x\<lparr>armKSASIDTable_' := Arrays.update (armKSASIDTable_' (globals x)) (unat (base >> local.asid_low_bits)) (ap_Ptr frame)\<rparr>)
 2. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b rv xfdc ret__struct_cap_C. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a; dc rv xfdc; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b rv\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1961 asid_base parenta slota framea rv' pcap y\<rbrace> placeNewObject frame makeObject 0 \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<or> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base))) parent and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) and cte_wp_at' (\<lambda>c. True) parent and ?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b a\<rbrace>
 4. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1956 asid_base parenta slota framea rv' pcap y rv'a rv'b) CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = capASIDBase_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && mask 17, capASIDPool_CL = capASIDPool_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && ~~ mask 4\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. destSlot_'_update (\<lambda>_. cte_Ptr slot) (srcSlot_'_update (\<lambda>_. cte_Ptr parent) (newCap_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}
 5. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>\<lambda>a. (\<lambda>s. \<exists>p. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?isdev1967 asid_base parenta slota framea rv' pcap a) frame pageBits (max_free_index pageBits)) p s) and pspace_aligned' and pspace_distinct' and valid_objs' and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {frame..+2 ^ pageBits}) and valid_global_refs' and pspace_no_overlap' frame pageBits and ?R1961 asid_base parenta slota framea rv' pcap a\<rbrace>
 6. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s. region_actually_is_bytes frame (2 ^ pageBits) s} \<inter> ?R'1956 asid_base parenta slota framea rv' pcap y (xfdc s) () \<inter> (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) \<inter> (if 0 \<le>s ARMSmallPageBits then UNIV else {})}}
 7. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 9. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 10. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (12 subgoals):
 1. \<And>ret__struct_cap_C \<sigma> x. \<lbrakk>is_aligned frame pageBits; base && mask local.asid_low_bits = 0; base \<le> mask local.asid_bits; is_aligned base local.asid_low_bits; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr>; cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']\<rbrakk> \<Longrightarrow> array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) ((armKSASIDTable (ksArchState \<sigma>))(UCAST(7 \<rightarrow> 32) (asid_high_bits_of base) \<mapsto> frame)) (Arrays.update (armKSASIDTable_' (globals x)) (unat (base >> local.asid_low_bits)) (ap_Ptr frame))
 2. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b rv xfdc ret__struct_cap_C. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a; dc rv xfdc; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b rv\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1961 asid_base parenta slota framea rv' pcap y\<rbrace> placeNewObject frame makeObject 0 \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<or> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base))) parent and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) and cte_wp_at' (\<lambda>c. True) parent and ?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b a\<rbrace>
 4. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1956 asid_base parenta slota framea rv' pcap y rv'a rv'b) CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = capASIDBase_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && mask 17, capASIDPool_CL = capASIDPool_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && ~~ mask 4\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. destSlot_'_update (\<lambda>_. cte_Ptr slot) (srcSlot_'_update (\<lambda>_. cte_Ptr parent) (newCap_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}
 5. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>\<lambda>a. (\<lambda>s. \<exists>p. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?isdev1967 asid_base parenta slota framea rv' pcap a) frame pageBits (max_free_index pageBits)) p s) and pspace_aligned' and pspace_distinct' and valid_objs' and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {frame..+2 ^ pageBits}) and valid_global_refs' and pspace_no_overlap' frame pageBits and ?R1961 asid_base parenta slota framea rv' pcap a\<rbrace>
 6. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s. region_actually_is_bytes frame (2 ^ pageBits) s} \<inter> ?R'1956 asid_base parenta slota framea rv' pcap y (xfdc s) () \<inter> (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) \<inter> (if 0 \<le>s ARMSmallPageBits then UNIV else {})}}
 7. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 9. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 10. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (12 subgoals):
 1. \<And>ret__struct_cap_C \<sigma> x. \<lbrakk>is_aligned frame pageBits; base && mask local.asid_low_bits = 0; base \<le> mask local.asid_bits; is_aligned base local.asid_low_bits; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr>; cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']\<rbrakk> \<Longrightarrow> array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) ((armKSASIDTable (ksArchState \<sigma>))(UCAST(7 \<rightarrow> 32) (UCAST(32 \<rightarrow> 7) (base >> local.asid_low_bits)) \<mapsto> frame)) (Arrays.update (armKSASIDTable_' (globals x)) (unat (base >> local.asid_low_bits)) (ap_Ptr frame))
 2. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b rv xfdc ret__struct_cap_C. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a; dc rv xfdc; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b rv\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1961 asid_base parenta slota framea rv' pcap y\<rbrace> placeNewObject frame makeObject 0 \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<or> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base))) parent and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) and cte_wp_at' (\<lambda>c. True) parent and ?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b a\<rbrace>
 4. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1956 asid_base parenta slota framea rv' pcap y rv'a rv'b) CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = capASIDBase_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && mask 17, capASIDPool_CL = capASIDPool_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && ~~ mask 4\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. destSlot_'_update (\<lambda>_. cte_Ptr slot) (srcSlot_'_update (\<lambda>_. cte_Ptr parent) (newCap_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}
 5. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>\<lambda>a. (\<lambda>s. \<exists>p. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?isdev1967 asid_base parenta slota framea rv' pcap a) frame pageBits (max_free_index pageBits)) p s) and pspace_aligned' and pspace_distinct' and valid_objs' and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {frame..+2 ^ pageBits}) and valid_global_refs' and pspace_no_overlap' frame pageBits and ?R1961 asid_base parenta slota framea rv' pcap a\<rbrace>
 6. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s. region_actually_is_bytes frame (2 ^ pageBits) s} \<inter> ?R'1956 asid_base parenta slota framea rv' pcap y (xfdc s) () \<inter> (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) \<inter> (if 0 \<le>s ARMSmallPageBits then UNIV else {})}}
 7. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 9. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 10. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (14 subgoals):
 1. \<And>ret__struct_cap_C \<sigma> x. \<lbrakk>is_aligned frame pageBits; base && mask local.asid_low_bits = 0; base \<le> mask local.asid_bits; is_aligned base local.asid_low_bits; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr>; cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']\<rbrakk> \<Longrightarrow> unat (base >> local.asid_low_bits) = unat (UCAST(7 \<rightarrow> 32) (UCAST(32 \<rightarrow> 7) (base >> local.asid_low_bits)))
 2. \<And>ret__struct_cap_C \<sigma> x. \<lbrakk>is_aligned frame pageBits; base && mask local.asid_low_bits = 0; base \<le> mask local.asid_bits; is_aligned base local.asid_low_bits; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr>; cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']\<rbrakk> \<Longrightarrow> ((=) \<circ> option_to_ptr) (Some frame) (ap_Ptr frame)
 3. \<And>ret__struct_cap_C \<sigma> x. \<lbrakk>is_aligned frame pageBits; base && mask local.asid_low_bits = 0; base \<le> mask local.asid_bits; is_aligned base local.asid_low_bits; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr>; cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']\<rbrakk> \<Longrightarrow> unat (2 ^ local.asid_high_bits - 1) < CARD(128)
 4. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b rv xfdc ret__struct_cap_C. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a; dc rv xfdc; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b rv\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot \<lbrace>\<lambda>a b. True\<rbrace>
 5. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1961 asid_base parenta slota framea rv' pcap y\<rbrace> placeNewObject frame makeObject 0 \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<or> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base))) parent and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) and cte_wp_at' (\<lambda>c. True) parent and ?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b a\<rbrace>
 6. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1956 asid_base parenta slota framea rv' pcap y rv'a rv'b) CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = capASIDBase_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && mask 17, capASIDPool_CL = capASIDPool_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && ~~ mask 4\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. destSlot_'_update (\<lambda>_. cte_Ptr slot) (srcSlot_'_update (\<lambda>_. cte_Ptr parent) (newCap_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}
 7. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>\<lambda>a. (\<lambda>s. \<exists>p. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?isdev1967 asid_base parenta slota framea rv' pcap a) frame pageBits (max_free_index pageBits)) p s) and pspace_aligned' and pspace_distinct' and valid_objs' and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {frame..+2 ^ pageBits}) and valid_global_refs' and pspace_no_overlap' frame pageBits and ?R1961 asid_base parenta slota framea rv' pcap a\<rbrace>
 8. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s. region_actually_is_bytes frame (2 ^ pageBits) s} \<inter> ?R'1956 asid_base parenta slota framea rv' pcap y (xfdc s) () \<inter> (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) \<inter> (if 0 \<le>s ARMSmallPageBits then UNIV else {})}}
 9. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (14 subgoals):
 1. \<And>ret__struct_cap_C \<sigma> x. \<lbrakk>is_aligned frame pageBits; base && mask local.asid_low_bits = 0; base \<le> mask local.asid_bits; is_aligned base local.asid_low_bits; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr>; cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']\<rbrakk> \<Longrightarrow> unat (base >> local.asid_low_bits) = unat (base >> local.asid_low_bits) mod 128
 2. \<And>ret__struct_cap_C \<sigma> x. \<lbrakk>is_aligned frame pageBits; base && mask local.asid_low_bits = 0; base \<le> mask local.asid_bits; is_aligned base local.asid_low_bits; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr>; cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']\<rbrakk> \<Longrightarrow> ((=) \<circ> option_to_ptr) (Some frame) (ap_Ptr frame)
 3. \<And>ret__struct_cap_C \<sigma> x. \<lbrakk>is_aligned frame pageBits; base && mask local.asid_low_bits = 0; base \<le> mask local.asid_bits; is_aligned base local.asid_low_bits; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr>; cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']\<rbrakk> \<Longrightarrow> unat (2 ^ local.asid_high_bits - 1) < CARD(128)
 4. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b rv xfdc ret__struct_cap_C. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a; dc rv xfdc; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b rv\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot \<lbrace>\<lambda>a b. True\<rbrace>
 5. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1961 asid_base parenta slota framea rv' pcap y\<rbrace> placeNewObject frame makeObject 0 \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<or> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base))) parent and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) and cte_wp_at' (\<lambda>c. True) parent and ?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b a\<rbrace>
 6. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1956 asid_base parenta slota framea rv' pcap y rv'a rv'b) CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = capASIDBase_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && mask 17, capASIDPool_CL = capASIDPool_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && ~~ mask 4\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. destSlot_'_update (\<lambda>_. cte_Ptr slot) (srcSlot_'_update (\<lambda>_. cte_Ptr parent) (newCap_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}
 7. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>\<lambda>a. (\<lambda>s. \<exists>p. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?isdev1967 asid_base parenta slota framea rv' pcap a) frame pageBits (max_free_index pageBits)) p s) and pspace_aligned' and pspace_distinct' and valid_objs' and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {frame..+2 ^ pageBits}) and valid_global_refs' and pspace_no_overlap' frame pageBits and ?R1961 asid_base parenta slota framea rv' pcap a\<rbrace>
 8. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s. region_actually_is_bytes frame (2 ^ pageBits) s} \<inter> ?R'1956 asid_base parenta slota framea rv' pcap y (xfdc s) () \<inter> (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) \<inter> (if 0 \<le>s ARMSmallPageBits then UNIV else {})}}
 9. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (14 subgoals):
 1. \<And>ret__struct_cap_C \<sigma> x. \<lbrakk>is_aligned frame pageBits; base && mask local.asid_low_bits = 0; is_aligned base local.asid_low_bits; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr>; cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; base >> local.asid_low_bits \<le> mask local.asid_high_bits\<rbrakk> \<Longrightarrow> unat (base >> local.asid_low_bits) = unat (base >> local.asid_low_bits) mod 128
 2. \<And>ret__struct_cap_C \<sigma> x. \<lbrakk>is_aligned frame pageBits; base && mask local.asid_low_bits = 0; base \<le> mask local.asid_bits; is_aligned base local.asid_low_bits; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr>; cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']\<rbrakk> \<Longrightarrow> ((=) \<circ> option_to_ptr) (Some frame) (ap_Ptr frame)
 3. \<And>ret__struct_cap_C \<sigma> x. \<lbrakk>is_aligned frame pageBits; base && mask local.asid_low_bits = 0; base \<le> mask local.asid_bits; is_aligned base local.asid_low_bits; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr>; cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']\<rbrakk> \<Longrightarrow> unat (2 ^ local.asid_high_bits - 1) < CARD(128)
 4. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b rv xfdc ret__struct_cap_C. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a; dc rv xfdc; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b rv\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot \<lbrace>\<lambda>a b. True\<rbrace>
 5. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1961 asid_base parenta slota framea rv' pcap y\<rbrace> placeNewObject frame makeObject 0 \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<or> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base))) parent and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) and cte_wp_at' (\<lambda>c. True) parent and ?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b a\<rbrace>
 6. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1956 asid_base parenta slota framea rv' pcap y rv'a rv'b) CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = capASIDBase_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && mask 17, capASIDPool_CL = capASIDPool_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && ~~ mask 4\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. destSlot_'_update (\<lambda>_. cte_Ptr slot) (srcSlot_'_update (\<lambda>_. cte_Ptr parent) (newCap_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}
 7. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>\<lambda>a. (\<lambda>s. \<exists>p. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?isdev1967 asid_base parenta slota framea rv' pcap a) frame pageBits (max_free_index pageBits)) p s) and pspace_aligned' and pspace_distinct' and valid_objs' and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {frame..+2 ^ pageBits}) and valid_global_refs' and pspace_no_overlap' frame pageBits and ?R1961 asid_base parenta slota framea rv' pcap a\<rbrace>
 8. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s. region_actually_is_bytes frame (2 ^ pageBits) s} \<inter> ?R'1956 asid_base parenta slota framea rv' pcap y (xfdc s) () \<inter> (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) \<inter> (if 0 \<le>s ARMSmallPageBits then UNIV else {})}}
 9. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (13 subgoals):
 1. \<And>ret__struct_cap_C \<sigma> x. \<lbrakk>is_aligned frame pageBits; base && mask local.asid_low_bits = 0; base \<le> mask local.asid_bits; is_aligned base local.asid_low_bits; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr>; cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']\<rbrakk> \<Longrightarrow> ((=) \<circ> option_to_ptr) (Some frame) (ap_Ptr frame)
 2. \<And>ret__struct_cap_C \<sigma> x. \<lbrakk>is_aligned frame pageBits; base && mask local.asid_low_bits = 0; base \<le> mask local.asid_bits; is_aligned base local.asid_low_bits; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr>; cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']\<rbrakk> \<Longrightarrow> unat (2 ^ local.asid_high_bits - 1) < CARD(128)
 3. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b rv xfdc ret__struct_cap_C. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a; dc rv xfdc; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b rv\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1961 asid_base parenta slota framea rv' pcap y\<rbrace> placeNewObject frame makeObject 0 \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<or> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base))) parent and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) and cte_wp_at' (\<lambda>c. True) parent and ?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b a\<rbrace>
 5. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1956 asid_base parenta slota framea rv' pcap y rv'a rv'b) CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = capASIDBase_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && mask 17, capASIDPool_CL = capASIDPool_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && ~~ mask 4\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. destSlot_'_update (\<lambda>_. cte_Ptr slot) (srcSlot_'_update (\<lambda>_. cte_Ptr parent) (newCap_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}
 6. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>\<lambda>a. (\<lambda>s. \<exists>p. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?isdev1967 asid_base parenta slota framea rv' pcap a) frame pageBits (max_free_index pageBits)) p s) and pspace_aligned' and pspace_distinct' and valid_objs' and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {frame..+2 ^ pageBits}) and valid_global_refs' and pspace_no_overlap' frame pageBits and ?R1961 asid_base parenta slota framea rv' pcap a\<rbrace>
 7. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s. region_actually_is_bytes frame (2 ^ pageBits) s} \<inter> ?R'1956 asid_base parenta slota framea rv' pcap y (xfdc s) () \<inter> (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) \<inter> (if 0 \<le>s ARMSmallPageBits then UNIV else {})}}
 8. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 10. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
A total of 13 subgoals...
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (13 subgoals):
 1. \<And>ret__struct_cap_C \<sigma> x. \<lbrakk>is_aligned frame pageBits; base && mask local.asid_low_bits = 0; base \<le> mask local.asid_bits; is_aligned base local.asid_low_bits; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr>; cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']\<rbrakk> \<Longrightarrow> option_to_ptr (Some frame) = ap_Ptr frame
 2. \<And>ret__struct_cap_C \<sigma> x. \<lbrakk>is_aligned frame pageBits; base && mask local.asid_low_bits = 0; base \<le> mask local.asid_bits; is_aligned base local.asid_low_bits; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr>; cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']\<rbrakk> \<Longrightarrow> unat (2 ^ local.asid_high_bits - 1) < CARD(128)
 3. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b rv xfdc ret__struct_cap_C. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a; dc rv xfdc; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b rv\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1961 asid_base parenta slota framea rv' pcap y\<rbrace> placeNewObject frame makeObject 0 \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<or> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base))) parent and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) and cte_wp_at' (\<lambda>c. True) parent and ?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b a\<rbrace>
 5. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1956 asid_base parenta slota framea rv' pcap y rv'a rv'b) CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = capASIDBase_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && mask 17, capASIDPool_CL = capASIDPool_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && ~~ mask 4\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. destSlot_'_update (\<lambda>_. cte_Ptr slot) (srcSlot_'_update (\<lambda>_. cte_Ptr parent) (newCap_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}
 6. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>\<lambda>a. (\<lambda>s. \<exists>p. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?isdev1967 asid_base parenta slota framea rv' pcap a) frame pageBits (max_free_index pageBits)) p s) and pspace_aligned' and pspace_distinct' and valid_objs' and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {frame..+2 ^ pageBits}) and valid_global_refs' and pspace_no_overlap' frame pageBits and ?R1961 asid_base parenta slota framea rv' pcap a\<rbrace>
 7. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s. region_actually_is_bytes frame (2 ^ pageBits) s} \<inter> ?R'1956 asid_base parenta slota framea rv' pcap y (xfdc s) () \<inter> (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) \<inter> (if 0 \<le>s ARMSmallPageBits then UNIV else {})}}
 8. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 10. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
A total of 13 subgoals...
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (12 subgoals):
 1. \<And>ret__struct_cap_C \<sigma> x. \<lbrakk>is_aligned frame pageBits; base && mask local.asid_low_bits = 0; base \<le> mask local.asid_bits; is_aligned base local.asid_low_bits; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr>; cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']\<rbrakk> \<Longrightarrow> unat (2 ^ local.asid_high_bits - 1) < CARD(128)
 2. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b rv xfdc ret__struct_cap_C. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a; dc rv xfdc; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b rv\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1961 asid_base parenta slota framea rv' pcap y\<rbrace> placeNewObject frame makeObject 0 \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<or> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base))) parent and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) and cte_wp_at' (\<lambda>c. True) parent and ?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b a\<rbrace>
 4. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1956 asid_base parenta slota framea rv' pcap y rv'a rv'b) CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = capASIDBase_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && mask 17, capASIDPool_CL = capASIDPool_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && ~~ mask 4\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. destSlot_'_update (\<lambda>_. cte_Ptr slot) (srcSlot_'_update (\<lambda>_. cte_Ptr parent) (newCap_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}
 5. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>\<lambda>a. (\<lambda>s. \<exists>p. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?isdev1967 asid_base parenta slota framea rv' pcap a) frame pageBits (max_free_index pageBits)) p s) and pspace_aligned' and pspace_distinct' and valid_objs' and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {frame..+2 ^ pageBits}) and valid_global_refs' and pspace_no_overlap' frame pageBits and ?R1961 asid_base parenta slota framea rv' pcap a\<rbrace>
 6. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s. region_actually_is_bytes frame (2 ^ pageBits) s} \<inter> ?R'1956 asid_base parenta slota framea rv' pcap y (xfdc s) () \<inter> (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) \<inter> (if 0 \<le>s ARMSmallPageBits then UNIV else {})}}
 7. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 9. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 10. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (11 subgoals):
 1. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b rv xfdc ret__struct_cap_C. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a; dc rv xfdc; cap_asid_pool_cap_lift ret__struct_cap_C = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<and> cap_get_tag ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b rv\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) parent slot \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1961 asid_base parenta slota framea rv' pcap y\<rbrace> placeNewObject frame makeObject 0 \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<or> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base))) parent and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) and cte_wp_at' (\<lambda>c. True) parent and ?R2146 asid_base parenta slota framea rv' pcap y rv'a rv'b a\<rbrace>
 3. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1956 asid_base parenta slota framea rv' pcap y rv'a rv'b) CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = capASIDBase_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && mask 17, capASIDPool_CL = capASIDPool_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && ~~ mask 4\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. destSlot_'_update (\<lambda>_. cte_Ptr slot) (srcSlot_'_update (\<lambda>_. cte_Ptr parent) (newCap_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}
 4. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>\<lambda>a. (\<lambda>s. \<exists>p. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?isdev1967 asid_base parenta slota framea rv' pcap a) frame pageBits (max_free_index pageBits)) p s) and pspace_aligned' and pspace_distinct' and valid_objs' and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {frame..+2 ^ pageBits}) and valid_global_refs' and pspace_no_overlap' frame pageBits and ?R1961 asid_base parenta slota framea rv' pcap a\<rbrace>
 5. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s. region_actually_is_bytes frame (2 ^ pageBits) s} \<inter> ?R'1956 asid_base parenta slota framea rv' pcap y (xfdc s) () \<inter> (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) \<inter> (if 0 \<le>s ARMSmallPageBits then UNIV else {})}}
 6. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 8. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 9. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 10. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and ?R1600 asid_base parenta slota framea y (xfdc s) rv and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> ?R'1594 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
A total of 11 subgoals...
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (10 subgoals):
 1. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1961 asid_base parenta slota framea rv' pcap y\<rbrace> placeNewObject frame makeObject 0 \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<or> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base))) parent s \<and> valid_mdb' s \<and> valid_objs' s \<and> pspace_aligned' s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) s \<and> cte_wp_at' (\<lambda>c. True) parent s \<and> True\<rbrace>
 2. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1956 asid_base parenta slota framea rv' pcap y rv'a rv'b) CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = capASIDBase_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && mask 17, capASIDPool_CL = capASIDPool_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && ~~ mask 4\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. destSlot_'_update (\<lambda>_. cte_Ptr slot) (srcSlot_'_update (\<lambda>_. cte_Ptr parent) (newCap_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}
 3. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>\<lambda>a. (\<lambda>s. \<exists>p. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?isdev1967 asid_base parenta slota framea rv' pcap a) frame pageBits (max_free_index pageBits)) p s) and pspace_aligned' and pspace_distinct' and valid_objs' and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {frame..+2 ^ pageBits}) and valid_global_refs' and pspace_no_overlap' frame pageBits and ?R1961 asid_base parenta slota framea rv' pcap a\<rbrace>
 4. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s. region_actually_is_bytes frame (2 ^ pageBits) s} \<inter> ?R'1956 asid_base parenta slota framea rv' pcap y (xfdc s) () \<inter> (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) \<inter> (if 0 \<le>s ARMSmallPageBits then UNIV else {})}}
 5. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 7. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 8. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 9. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and ?R1600 asid_base parenta slota framea y (xfdc s) rv and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> ?R'1594 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 10. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (10 subgoals):
 1. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1961 asid_base parenta slota framea rv' pcap y\<rbrace> placeNewObject frame makeObject 0 \<lbrace>\<lambda>r s. cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<or> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base))) parent s \<and> valid_pspace' s \<and> valid_pspace' s \<and> valid_pspace' s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) s \<and> cte_wp_at' (\<lambda>c. True) parent s \<and> True\<rbrace>
 2. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1956 asid_base parenta slota framea rv' pcap y rv'a rv'b) CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = capASIDBase_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && mask 17, capASIDPool_CL = capASIDPool_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && ~~ mask 4\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. destSlot_'_update (\<lambda>_. cte_Ptr slot) (srcSlot_'_update (\<lambda>_. cte_Ptr parent) (newCap_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}
 3. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>\<lambda>a. (\<lambda>s. \<exists>p. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?isdev1967 asid_base parenta slota framea rv' pcap a) frame pageBits (max_free_index pageBits)) p s) and pspace_aligned' and pspace_distinct' and valid_objs' and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {frame..+2 ^ pageBits}) and valid_global_refs' and pspace_no_overlap' frame pageBits and ?R1961 asid_base parenta slota framea rv' pcap a\<rbrace>
 4. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s. region_actually_is_bytes frame (2 ^ pageBits) s} \<inter> ?R'1956 asid_base parenta slota framea rv' pcap y (xfdc s) () \<inter> (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) \<inter> (if 0 \<le>s ARMSmallPageBits then UNIV else {})}}
 5. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 7. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 8. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 9. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and ?R1600 asid_base parenta slota framea y (xfdc s) rv and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> ?R'1594 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 10. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (10 subgoals):
 1. \<And>rv'. \<lbrakk>is_aligned frame pageBits; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1961 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) rv' (capability.UntypedCap isdev frame pageBits idx) ()\<rbrace> createObjects' frame (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>\<lambda>r s. valid_pspace' s \<and> cte_wp_at' (\<lambda>scte. True) parent s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) s\<rbrace>
 2. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1956 asid_base parenta slota framea rv' pcap y rv'a rv'b) CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = capASIDBase_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && mask 17, capASIDPool_CL = capASIDPool_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && ~~ mask 4\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. destSlot_'_update (\<lambda>_. cte_Ptr slot) (srcSlot_'_update (\<lambda>_. cte_Ptr parent) (newCap_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}
 3. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>\<lambda>a. (\<lambda>s. \<exists>p. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?isdev1967 asid_base parenta slota framea rv' pcap a) frame pageBits (max_free_index pageBits)) p s) and pspace_aligned' and pspace_distinct' and valid_objs' and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {frame..+2 ^ pageBits}) and valid_global_refs' and pspace_no_overlap' frame pageBits and ?R1961 asid_base parenta slota framea rv' pcap a\<rbrace>
 4. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s. region_actually_is_bytes frame (2 ^ pageBits) s} \<inter> ?R'1956 asid_base parenta slota framea rv' pcap y (xfdc s) () \<inter> (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) \<inter> (if 0 \<le>s ARMSmallPageBits then UNIV else {})}}
 5. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 7. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 8. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 9. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and ?R1600 asid_base parenta slota framea y (xfdc s) rv and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> ?R'1594 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 10. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (10 subgoals):
 1. \<And>rv'. \<lbrakk>is_aligned frame pageBits; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits\<rbrakk> \<Longrightarrow> \<lbrace>?P'2322 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) rv' (capability.UntypedCap isdev frame pageBits idx) ()\<rbrace> createObjects' frame (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>\<lambda>rv. valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base))\<rbrace>
 2. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1956 asid_base parenta slota framea rv' pcap y rv'a rv'b) CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = capASIDBase_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && mask 17, capASIDPool_CL = capASIDPool_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && ~~ mask 4\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. destSlot_'_update (\<lambda>_. cte_Ptr slot) (srcSlot_'_update (\<lambda>_. cte_Ptr parent) (newCap_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}
 3. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>\<lambda>a. (\<lambda>s. \<exists>p. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?isdev1967 asid_base parenta slota framea rv' pcap a) frame pageBits (max_free_index pageBits)) p s) and pspace_aligned' and pspace_distinct' and valid_objs' and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {frame..+2 ^ pageBits}) and valid_global_refs' and pspace_no_overlap' frame pageBits and (\<lambda>b. (pspace_no_overlap' frame pageBits b \<and> valid_pspace' b \<and> caps_no_overlap'' frame pageBits b \<and> caps_overlap_reserved' {frame..frame + word_of_nat (Suc 0 * 2 ^ 0 * 2 ^ objBitsKO (KOArch (KOASIDPool makeObject))) - 1} b \<and> frame \<noteq> 0) \<and> (cte_wp_at' (\<lambda>a. True) parent b \<and> valid_pspace' b \<and> pspace_no_overlap' frame pageBits b) \<and> ?P'2322 asid_base parenta slota framea rv' pcap a b)\<rbrace>
 4. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s. region_actually_is_bytes frame (2 ^ pageBits) s} \<inter> ?R'1956 asid_base parenta slota framea rv' pcap y (xfdc s) () \<inter> (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) \<inter> (if 0 \<le>s ARMSmallPageBits then UNIV else {})}}
 5. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 7. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 8. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 9. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and ?R1600 asid_base parenta slota framea y (xfdc s) rv and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> ?R'1594 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 10. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (10 subgoals):
 1. \<And>rv'. \<lbrakk>is_aligned frame pageBits; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits\<rbrakk> \<Longrightarrow> \<lbrace>?P'2322 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) rv' (capability.UntypedCap isdev frame pageBits idx) ()\<rbrace> createObjects' frame (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>\<lambda>rv s. is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_pool_at' frame s \<and> base < 2 ^ local.asid_bits\<rbrace>
 2. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1956 asid_base parenta slota framea rv' pcap y rv'a rv'b) CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = capASIDBase_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && mask 17, capASIDPool_CL = capASIDPool_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && ~~ mask 4\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. destSlot_'_update (\<lambda>_. cte_Ptr slot) (srcSlot_'_update (\<lambda>_. cte_Ptr parent) (newCap_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}
 3. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>\<lambda>a. (\<lambda>s. \<exists>p. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?isdev1967 asid_base parenta slota framea rv' pcap a) frame pageBits (max_free_index pageBits)) p s) and pspace_aligned' and pspace_distinct' and valid_objs' and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {frame..+2 ^ pageBits}) and valid_global_refs' and pspace_no_overlap' frame pageBits and (\<lambda>b. (pspace_no_overlap' frame pageBits b \<and> valid_pspace' b \<and> caps_no_overlap'' frame pageBits b \<and> caps_overlap_reserved' {frame..frame + word_of_nat (Suc 0 * 2 ^ 0 * 2 ^ objBitsKO (KOArch (KOASIDPool makeObject))) - 1} b \<and> frame \<noteq> 0) \<and> (cte_wp_at' (\<lambda>a. True) parent b \<and> valid_pspace' b \<and> pspace_no_overlap' frame pageBits b) \<and> ?P'2322 asid_base parenta slota framea rv' pcap a b)\<rbrace>
 4. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s. region_actually_is_bytes frame (2 ^ pageBits) s} \<inter> ?R'1956 asid_base parenta slota framea rv' pcap y (xfdc s) () \<inter> (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) \<inter> (if 0 \<le>s ARMSmallPageBits then UNIV else {})}}
 5. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 7. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 8. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 9. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and ?R1600 asid_base parenta slota framea y (xfdc s) rv and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> ?R'1594 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 10. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (9 subgoals):
 1. \<And>asid_base parenta slota framea rv' pcap y rv'a rv'b. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx; dc y rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1956 asid_base parenta slota framea rv' pcap y rv'a rv'b) CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame)))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = capASIDBase_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && mask 17, capASIDPool_CL = capASIDPool_' (capASIDPool_'_update (\<lambda>_. frame) (capASIDBase_'_update (\<lambda>_. base) s)) && ~~ mask 4\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> s\<lparr>ret__struct_cap_C_' := v\<rparr> \<in> {s. destSlot_'_update (\<lambda>_. cte_Ptr slot) (srcSlot_'_update (\<lambda>_. cte_Ptr parent) (newCap_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr parent\<rbrace> \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) \<acute>newCap\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}}
 2. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>\<lambda>a. (\<lambda>s. \<exists>p. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?isdev1967 asid_base parenta slota framea rv' pcap a) frame pageBits (max_free_index pageBits)) p s) and pspace_aligned' and pspace_distinct' and valid_objs' and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {frame..+2 ^ pageBits}) and valid_global_refs' and pspace_no_overlap' frame pageBits and (\<lambda>a. (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> caps_no_overlap'' frame pageBits a \<and> caps_overlap_reserved' {frame..frame + word_of_nat (Suc 0 * 2 ^ 0 * 2 ^ objBitsKO (KOArch (KOASIDPool makeObject))) - 1} a \<and> frame \<noteq> 0) \<and> (cte_wp_at' (\<lambda>a. True) parent a \<and> valid_pspace' a \<and> pspace_no_overlap' frame pageBits a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> (koTypeOf (KOArch (KOASIDPool makeObject)) = ArchT ASIDPoolT \<and> is_aligned frame (objBitsKO (KOArch (KOASIDPool makeObject))) \<and> pspace_aligned' a \<and> pspace_no_overlap' frame (objBitsKO (KOArch (KOASIDPool makeObject))) a) \<and> asid_base < 2 ^ local.asid_bits)\<rbrace>
 3. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s. region_actually_is_bytes frame (2 ^ pageBits) s} \<inter> ?R'1956 asid_base parenta slota framea rv' pcap y (xfdc s) () \<inter> (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) \<inter> (if 0 \<le>s ARMSmallPageBits then UNIV else {})}}
 4. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 6. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 7. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 8. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and ?R1600 asid_base parenta slota framea y (xfdc s) rv and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> ?R'1594 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 9. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (9 subgoals):
 1. \<And>rv' rv'a. \<lbrakk>is_aligned frame pageBits; base \<le> mask local.asid_bits; is_aligned base local.asid_low_bits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1956 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) rv' (capability.UntypedCap isdev frame pageBits idx) () rv'a ()) CALL memzero_'proc(PTR(unit) frame,2 ^ unat ARMSmallPageBits);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ap_Ptr frame)))) (if \<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v then UNIV else {})
 2. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>\<lambda>a. (\<lambda>s. \<exists>p. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?isdev1967 asid_base parenta slota framea rv' pcap a) frame pageBits (max_free_index pageBits)) p s) and pspace_aligned' and pspace_distinct' and valid_objs' and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {frame..+2 ^ pageBits}) and valid_global_refs' and pspace_no_overlap' frame pageBits and (\<lambda>a. (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> caps_no_overlap'' frame pageBits a \<and> caps_overlap_reserved' {frame..frame + word_of_nat (Suc 0 * 2 ^ 0 * 2 ^ objBitsKO (KOArch (KOASIDPool makeObject))) - 1} a \<and> frame \<noteq> 0) \<and> (cte_wp_at' (\<lambda>a. True) parent a \<and> valid_pspace' a \<and> pspace_no_overlap' frame pageBits a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> (koTypeOf (KOArch (KOASIDPool makeObject)) = ArchT ASIDPoolT \<and> is_aligned frame (objBitsKO (KOArch (KOASIDPool makeObject))) \<and> pspace_aligned' a \<and> pspace_no_overlap' frame (objBitsKO (KOArch (KOASIDPool makeObject))) a) \<and> asid_base < 2 ^ local.asid_bits)\<rbrace>
 3. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> {s. region_actually_is_bytes frame (2 ^ pageBits) s} \<inter> ?R'1956 asid_base parenta slota framea rv' pcap y (xfdc s) () \<inter> (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) \<inter> (if 0 \<le>s ARMSmallPageBits then UNIV else {})}}
 4. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 6. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 7. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 8. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and ?R1600 asid_base parenta slota framea y (xfdc s) rv and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> ?R'1594 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 9. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (8 subgoals):
 1. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>\<lambda>a. (\<lambda>s. \<exists>p. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?isdev1967 asid_base parenta slota framea rv' pcap a) frame pageBits (max_free_index pageBits)) p s) and pspace_aligned' and pspace_distinct' and valid_objs' and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {frame..+2 ^ pageBits}) and valid_global_refs' and pspace_no_overlap' frame pageBits and (\<lambda>a. (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> caps_no_overlap'' frame pageBits a \<and> caps_overlap_reserved' {frame..frame + word_of_nat (Suc 0 * 2 ^ 0 * 2 ^ objBitsKO (KOArch (KOASIDPool makeObject))) - 1} a \<and> frame \<noteq> 0) \<and> (cte_wp_at' (\<lambda>a. True) parent a \<and> valid_pspace' a \<and> pspace_no_overlap' frame pageBits a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> (koTypeOf (KOArch (KOASIDPool makeObject)) = ArchT ASIDPoolT \<and> is_aligned frame (objBitsKO (KOArch (KOASIDPool makeObject))) \<and> pspace_aligned' a \<and> pspace_no_overlap' frame (objBitsKO (KOArch (KOASIDPool makeObject))) a) \<and> asid_base < 2 ^ local.asid_bits)\<rbrace>
 2. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {s. s \<in> {s. region_actually_is_bytes frame (2 ^ pageBits) s} \<inter> {s. ptr_val framea \<noteq> 0 \<and> ptr_val framea \<le> ptr_val framea + (2 ^ unat ARMSmallPageBits - 1) \<and> is_aligned (ptr_val framea) 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> {ptr_val framea..+unat (2 ^ unat ARMSmallPageBits)} \<times> insert SIndexVal {x. SIndexTyp 0 = x} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {2 ^ unat ARMSmallPageBits..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val framea) (replicate (unat (2 ^ unat ARMSmallPageBits)) (UCAST(?'a2370 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> s\<lparr>globals := globals s\<lparr>t_hrs_' := hrs_htd_update (ptr_retyp (ap_Ptr frame)) (t_hrs_' (globals t))\<rparr>\<rparr> \<in> (if \<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = asid_base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame asid_base)) v then UNIV else {}))} \<inter> (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) \<inter> (if 0 \<le>s ARMSmallPageBits then UNIV else {})}}
 3. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 5. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 6. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 7. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and ?R1600 asid_base parenta slota framea y (xfdc s) rv and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> ?R'1594 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 8. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (8 subgoals):
 1. \<And>rv'. \<lbrakk>is_aligned frame pageBits; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1600 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>\<lambda>r s. invs' s \<and> frame \<noteq> 0 \<and> pspace_no_overlap' frame pageBits s \<and> caps_no_overlap'' frame pageBits s \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>a. True) parent s \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> base < 2 ^ local.asid_bits \<and> caps_overlap_reserved' {frame..+2 ^ pageBits} s \<and> caps_overlap_reserved' {frame..frame + 2 ^ pageBits - 1} s \<and> (\<exists>p. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?isdev1967 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) rv' (capability.UntypedCap isdev frame pageBits idx) ()) frame pageBits (max_free_index pageBits)) p s)\<rbrace>
 2. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {s. s \<in> {s. region_actually_is_bytes frame (2 ^ pageBits) s} \<inter> {s. ptr_val framea \<noteq> 0 \<and> ptr_val framea \<le> ptr_val framea + (2 ^ unat ARMSmallPageBits - 1) \<and> is_aligned (ptr_val framea) 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> {ptr_val framea..+unat (2 ^ unat ARMSmallPageBits)} \<times> insert SIndexVal {x. SIndexTyp 0 = x} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {2 ^ unat ARMSmallPageBits..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val framea) (replicate (unat (2 ^ unat ARMSmallPageBits)) (UCAST(?'a2370 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> s\<lparr>globals := globals s\<lparr>t_hrs_' := hrs_htd_update (ptr_retyp (ap_Ptr frame)) (t_hrs_' (globals t))\<rparr>\<rparr> \<in> (if \<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = asid_base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame asid_base)) v then UNIV else {}))} \<inter> (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) \<inter> (if 0 \<le>s ARMSmallPageBits then UNIV else {})}}
 3. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and ?R1600 asid_base parenta slota framea y rv' pcap and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 5. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 6. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 7. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and ?R1600 asid_base parenta slota framea y (xfdc s) rv and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> ?R'1594 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 8. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (8 subgoals):
 1. \<And>rv'. \<lbrakk>is_aligned frame pageBits; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits\<rbrakk> \<Longrightarrow> \<lbrace>?P'2469 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>\<lambda>rv s. \<exists>p. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?isdev1967 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) rv' (capability.UntypedCap isdev frame pageBits idx) ()) frame pageBits (max_free_index pageBits)) p s\<rbrace>
 2. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {s. s \<in> {s. region_actually_is_bytes frame (2 ^ pageBits) s} \<inter> {s. ptr_val framea \<noteq> 0 \<and> ptr_val framea \<le> ptr_val framea + (2 ^ unat ARMSmallPageBits - 1) \<and> is_aligned (ptr_val framea) 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> {ptr_val framea..+unat (2 ^ unat ARMSmallPageBits)} \<times> insert SIndexVal {x. SIndexTyp 0 = x} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {2 ^ unat ARMSmallPageBits..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val framea) (replicate (unat (2 ^ unat ARMSmallPageBits)) (UCAST(?'a2370 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> s\<lparr>globals := globals s\<lparr>t_hrs_' := hrs_htd_update (ptr_retyp (ap_Ptr frame)) (t_hrs_' (globals t))\<rparr>\<rparr> \<in> (if \<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = asid_base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame asid_base)) v then UNIV else {}))} \<inter> (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) \<inter> (if 0 \<le>s ARMSmallPageBits then UNIV else {})}}
 3. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) parent a) \<and> frame \<noteq> 0 \<and> (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> (caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> (valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..+2 ^ pageBits} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> (valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> ?P'2469 asid_base parenta slota framea y rv' pcap a) and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 5. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 6. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 7. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) parent a) \<and> frame \<noteq> 0 \<and> (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> (caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> (valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..+2 ^ pageBits} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> (valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> ?P'2469 asid_base parenta slota framea y (xfdc s) rv a) and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> ?R'1594 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 8. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (8 subgoals):
 1. \<And>rv'. \<lbrakk>is_aligned frame pageBits; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits\<rbrakk> \<Longrightarrow> \<lbrace>?P'2469 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)\<rbrace> updateFreeIndex parent (max_free_index pageBits) \<lbrace>\<lambda>r. cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?isdev1967 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) rv' (capability.UntypedCap isdev frame pageBits idx) ()) frame pageBits (max_free_index pageBits)) parent\<rbrace>
 2. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {s. s \<in> {s. region_actually_is_bytes frame (2 ^ pageBits) s} \<inter> {s. ptr_val framea \<noteq> 0 \<and> ptr_val framea \<le> ptr_val framea + (2 ^ unat ARMSmallPageBits - 1) \<and> is_aligned (ptr_val framea) 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> {ptr_val framea..+unat (2 ^ unat ARMSmallPageBits)} \<times> insert SIndexVal {x. SIndexTyp 0 = x} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {2 ^ unat ARMSmallPageBits..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val framea) (replicate (unat (2 ^ unat ARMSmallPageBits)) (UCAST(?'a2370 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> s\<lparr>globals := globals s\<lparr>t_hrs_' := hrs_htd_update (ptr_retyp (ap_Ptr frame)) (t_hrs_' (globals t))\<rparr>\<rparr> \<in> (if \<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = asid_base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame asid_base)) v then UNIV else {}))} \<inter> (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) \<inter> (if 0 \<le>s ARMSmallPageBits then UNIV else {})}}
 3. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) parent a) \<and> frame \<noteq> 0 \<and> (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> (caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> (valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..+2 ^ pageBits} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> (valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> ?P'2469 asid_base parenta slota framea y rv' pcap a) and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 5. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 6. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 7. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) parent a) \<and> frame \<noteq> 0 \<and> (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> (caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> (valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..+2 ^ pageBits} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> (valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> ?P'2469 asid_base parenta slota framea y (xfdc s) rv a) and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> ?R'1594 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 8. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (7 subgoals):
 1. \<And>asid_base parenta slota framea rv' pcap. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; pcap = capability.UntypedCap isdev frame pageBits idx\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 asid_base parenta slota framea rv' pcap\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {s. s \<in> {s. region_actually_is_bytes frame (2 ^ pageBits) s} \<inter> {s. ptr_val framea \<noteq> 0 \<and> ptr_val framea \<le> ptr_val framea + (2 ^ unat ARMSmallPageBits - 1) \<and> is_aligned (ptr_val framea) 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> {ptr_val framea..+unat (2 ^ unat ARMSmallPageBits)} \<times> insert SIndexVal {x. SIndexTyp 0 = x} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) \<in> insert 0 {2 ^ unat ARMSmallPageBits..} \<and> (\<forall>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list (ptr_val framea) (replicate (unat (2 ^ unat ARMSmallPageBits)) (UCAST(?'a2370 \<rightarrow> 8) 0))) (t_hrs_' (globals s)) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> s\<lparr>globals := globals s\<lparr>t_hrs_' := hrs_htd_update (ptr_retyp (ap_Ptr frame)) (t_hrs_' (globals t))\<rparr>\<rparr> \<in> (if \<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = asid_base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame asid_base)) v then UNIV else {}))} \<inter> (if 2 ^ unat ARMSmallPageBits < 2147483648 then UNIV else {}) \<inter> (if 0 \<le>s ARMSmallPageBits then UNIV else {})}}
 2. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) parent a) \<and> frame \<noteq> 0 \<and> (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> (caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> (valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..+2 ^ pageBits} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> (valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if parent = parent then capFreeIndex_update (\<lambda>_. max_free_index pageBits) else id) c) = capability.UntypedCap (?isdev2482 asid_base parenta slota framea y rv' pcap) frame pageBits (max_free_index pageBits)) parent a) and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 4. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 5. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 6. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) parent a) \<and> frame \<noteq> 0 \<and> (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> (caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> (valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..+2 ^ pageBits} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> (valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if parent = parent then capFreeIndex_update (\<lambda>_. max_free_index pageBits) else id) c) = capability.UntypedCap (?isdev2482 asid_base parenta slota framea y (xfdc s) rv) frame pageBits (max_free_index pageBits)) parent a) and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> ?R'1594 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 7. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
\<lambda>rv'. ?isdev2482 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx) \<equiv>\<^sup>? \<lambda>rv'. ?isdev1967 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) rv' (capability.UntypedCap isdev frame pageBits idx) ()
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (7 subgoals):
 1. \<And>rv'. \<lbrakk>is_aligned frame pageBits; base \<le> mask local.asid_bits; is_aligned base local.asid_low_bits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1592 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) rv' (capability.UntypedCap isdev frame pageBits idx)\<^esub> (?R'1594 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx)) Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capBlockSize_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr parent} (Guard ShiftError \<lbrace>\<acute>ret__unsigned - 4 < 0x20\<rbrace> (CALL cap_untyped_cap_ptr_set_capFreeIndex_'proc(cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']),2 ^ unat (\<acute>ret__unsigned - 4)))) {s. region_actually_is_bytes frame (2 ^ pageBits) s \<and> frame \<noteq> 0 \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals s))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s))) \<and> ((\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals s))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> (\<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v)) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> 0 \<le>s ARMSmallPageBits}
 2. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) parent a) \<and> frame \<noteq> 0 \<and> (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> (caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> (valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..+2 ^ pageBits} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> (valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if parent = parent then capFreeIndex_update (\<lambda>_. max_free_index pageBits) else id) c) = capability.UntypedCap (?isdev2482 asid_base parenta slota framea y rv' pcap) frame pageBits (max_free_index pageBits)) parent a) and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 4. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 5. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 6. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) parent a) \<and> frame \<noteq> 0 \<and> (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> (caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> (valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..+2 ^ pageBits} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> (valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if parent = parent then capFreeIndex_update (\<lambda>_. max_free_index pageBits) else id) c) = capability.UntypedCap (?isdev2482 asid_base parenta slota framea y (xfdc s) rv) frame pageBits (max_free_index pageBits)) parent a) and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> ?R'1594 asid_base parenta slota framea y (xfdc s) rv}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 7. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
\<lambda>rv'. ?isdev2482 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx) \<equiv>\<^sup>? \<lambda>rv'. ?isdev1967 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) rv' (capability.UntypedCap isdev frame pageBits idx) ()
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (6 subgoals):
 1. \<And>asid_base parenta slota framea y rv' s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getSlotCap parent \<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) parent a) \<and> frame \<noteq> 0 \<and> (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> (caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> (valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..+2 ^ pageBits} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> (valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if parent = parent then capFreeIndex_update (\<lambda>_. max_free_index pageBits) else id) c) = capability.UntypedCap (?isdev2482 asid_base parenta slota framea y rv' pcap) frame pageBits (max_free_index pageBits)) parent a) and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 3. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 4. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 5. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) parent a) \<and> frame \<noteq> 0 \<and> (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> (caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> (valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..+2 ^ pageBits} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> (valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if parent = parent then capFreeIndex_update (\<lambda>_. max_free_index pageBits) else id) c) = capability.UntypedCap (?isdev2482 asid_base parenta slota framea y (xfdc s) rv) frame pageBits (max_free_index pageBits)) parent a) and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> {s. s \<Turnstile>\<^sub>c parenta \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<noteq> 0 \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = asid_base && mask 17, capASIDPool_CL = frame && ~~ mask 4, \<dots> = y\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame asid_base)) v)) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> 0 \<le>s ARMSmallPageBits))}}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 6. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
\<lambda>rv'. ?isdev2482 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx) \<equiv>\<^sup>? \<lambda>rv'. ?isdev1967 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) rv' (capability.UntypedCap isdev frame pageBits idx) ()
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (5 subgoals):
 1. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 asid_base parenta slota framea y\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap. valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) parent a) \<and> frame \<noteq> 0 \<and> (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> (caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> (valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..+2 ^ pageBits} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> (valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if parent = parent then capFreeIndex_update (\<lambda>_. max_free_index pageBits) else id) c) = capability.UntypedCap (?isdev2482 asid_base parenta slota framea y rv' pcap) frame pageBits (max_free_index pageBits)) parent a) and (\<lambda>_. pcap = capability.UntypedCap isdev frame pageBits idx)\<rbrace>
 2. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 3. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 4. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) parent a) \<and> frame \<noteq> 0 \<and> (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> (caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> (valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..+2 ^ pageBits} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> (valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if parent = parent then capFreeIndex_update (\<lambda>_. max_free_index pageBits) else id) c) = capability.UntypedCap (?isdev2482 asid_base parenta slota framea y (xfdc s) rv) frame pageBits (max_free_index pageBits)) parent a) and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> {s. s \<Turnstile>\<^sub>c parenta \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<noteq> 0 \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = asid_base && mask 17, capASIDPool_CL = frame && ~~ mask 4, \<dots> = y\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame asid_base)) v)) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> 0 \<le>s ARMSmallPageBits))}}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 5. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
\<lambda>rv'. ?isdev2482 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx) \<equiv>\<^sup>? \<lambda>rv'. ?isdev1967 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) rv' (capability.UntypedCap isdev frame pageBits idx) ()
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (5 subgoals):
 1. \<And>rv'. \<lbrakk>is_aligned frame pageBits; base \<le> mask local.asid_bits; is_aligned base local.asid_low_bits\<rbrakk> \<Longrightarrow> \<lbrace>?Q1523 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) ()\<rbrace> getSlotCap parent \<lbrace>\<lambda>pcap a. valid_objs' a \<and> cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> pcap = cteCap cte) parent a \<and> untyped_ranges_zero' a \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize pcap \<and> invs' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capFreeIndex (cteCap a) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize (cteCap a) \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) parent a \<and> frame \<noteq> 0 \<and> pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) parent a \<and> caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) parent a \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> base < 2 ^ local.asid_bits \<and> valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' (\<lambda>a. {frame..+2 ^ pageBits} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap a)) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap (cteCap a)) parent a \<and> valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' (\<lambda>a. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap a)) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap (cteCap a)) parent a \<and> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap c) = capability.UntypedCap (?isdev2482 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' pcap) frame pageBits (max_free_index pageBits)) parent a \<and> pcap = capability.UntypedCap isdev frame pageBits idx\<rbrace>
 2. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 3. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>?Q1523 asid_base parenta slota framea\<rbrace>
 4. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv sa. (sa, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) parent a) \<and> frame \<noteq> 0 \<and> (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> (caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> (valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..+2 ^ pageBits} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> (valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if parent = parent then capFreeIndex_update (\<lambda>_. max_free_index pageBits) else id) c) = capability.UntypedCap (?isdev2482 asid_base parenta slota framea y (xfdc s) rv) frame pageBits (max_free_index pageBits)) parent a) and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) sa \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> {s. s \<Turnstile>\<^sub>c parenta \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<noteq> 0 \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = asid_base && mask 17, capASIDPool_CL = frame && ~~ mask 4, \<dots> = y\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame asid_base)) v)) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> 0 \<le>s ARMSmallPageBits))}}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 5. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
\<lambda>rv'. ?isdev2482 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () rv' (capability.UntypedCap isdev frame pageBits idx) \<equiv>\<^sup>? \<lambda>rv'. ?isdev1967 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) rv' (capability.UntypedCap isdev frame pageBits idx) ()
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (4 subgoals):
 1. \<And>asid_base parenta slota framea y rv'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; dc y rv'\<rbrakk> \<Longrightarrow> empty_fail (getSlotCap parent)
 2. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>\<lambda>a b. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) parent b \<and> valid_objs' b \<and> cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cap = cteCap cte) parent b \<and> untyped_ranges_zero' b \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> invs' b \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capFreeIndex (cteCap a) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize (cteCap a) \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) parent b \<and> frame \<noteq> 0 \<and> pspace_no_overlap' frame pageBits b \<and> valid_pspace' b \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) parent b \<and> caps_no_overlap'' frame pageBits b \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) parent b \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent b \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> valid_pspace' b \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of b) \<and> cte_wp_at' (\<lambda>a. {frame..+2 ^ pageBits} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap a)) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap (cteCap a)) parent b \<and> valid_pspace' b \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of b) \<and> cte_wp_at' (\<lambda>a. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap a)) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap (cteCap a)) parent b \<and> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap c) = capability.UntypedCap (?isdev2550 asid_base parenta slota framea a cap) frame pageBits (max_free_index pageBits)) parent b \<and> cap = capability.UntypedCap isdev frame pageBits idx\<rbrace>
 3. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) parent a) \<and> frame \<noteq> 0 \<and> (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> (caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> (valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..+2 ^ pageBits} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> (valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if parent = parent then capFreeIndex_update (\<lambda>_. max_free_index pageBits) else id) c) = capability.UntypedCap (?isdev2551 asid_base parenta slota framea y rv) frame pageBits (max_free_index pageBits)) parent a) and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) s \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> {s. s \<Turnstile>\<^sub>c parenta \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<noteq> 0 \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = asid_base && mask 17, capASIDPool_CL = frame && ~~ mask 4, \<dots> = y\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame asid_base)) v)) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> 0 \<le>s ARMSmallPageBits))}}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 4. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?isdev2551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () \<equiv>\<^sup>? ?isdev2550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) ()
?isdev2551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (capability.UntypedCap isdev frame pageBits idx) \<equiv>\<^sup>? ?isdev2553 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) (capability.UntypedCap isdev frame pageBits idx) ()
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (3 subgoals):
 1. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>\<lambda>a b. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) parent b \<and> valid_objs' b \<and> cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cap = cteCap cte) parent b \<and> untyped_ranges_zero' b \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> invs' b \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capFreeIndex (cteCap a) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize (cteCap a) \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) parent b \<and> frame \<noteq> 0 \<and> pspace_no_overlap' frame pageBits b \<and> valid_pspace' b \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) parent b \<and> caps_no_overlap'' frame pageBits b \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) parent b \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent b \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> valid_pspace' b \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of b) \<and> cte_wp_at' (\<lambda>a. {frame..+2 ^ pageBits} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap a)) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap (cteCap a)) parent b \<and> valid_pspace' b \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of b) \<and> cte_wp_at' (\<lambda>a. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap a)) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap (cteCap a)) parent b \<and> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap c) = capability.UntypedCap (?isdev2550 asid_base parenta slota framea a cap) frame pageBits (max_free_index pageBits)) parent b \<and> cap = capability.UntypedCap isdev frame pageBits idx\<rbrace>
 2. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) parent a) \<and> frame \<noteq> 0 \<and> (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> (caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> (valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..+2 ^ pageBits} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> (valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if parent = parent then capFreeIndex_update (\<lambda>_. max_free_index pageBits) else id) c) = capability.UntypedCap (?isdev2551 asid_base parenta slota framea y rv) frame pageBits (max_free_index pageBits)) parent a) and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) s \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> {s. s \<Turnstile>\<^sub>c parenta \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<noteq> 0 \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = asid_base && mask 17, capASIDPool_CL = frame && ~~ mask 4, \<dots> = y\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame asid_base)) v)) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> 0 \<le>s ARMSmallPageBits))}}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 3. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?isdev2551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () \<equiv>\<^sup>? ?isdev2550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) ()
?isdev2553 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) (capability.UntypedCap isdev frame pageBits idx) () \<equiv>\<^sup>? ?isdev2551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (capability.UntypedCap isdev frame pageBits idx)
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (4 subgoals):
 1. \<And>asid_base parenta slota framea rv s. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits; (cte_wp_at' ((=) (capability.UntypedCap isdev frame pageBits idx) \<circ> cteCap) parent and (\<lambda>s. descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s)) and pspace_no_overlap' frame pageBits and invs' and ct_active') s\<rbrakk> \<Longrightarrow> \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) parent s \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cap = cteCap cte) parent s \<and> untyped_ranges_zero' s \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> invs' s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capFreeIndex (cteCap a) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize (cteCap a) \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) parent s \<and> frame \<noteq> 0 \<and> pspace_no_overlap' frame pageBits s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) parent s \<and> caps_no_overlap'' frame pageBits s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) parent s \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent s \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> valid_pspace' s \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of s) \<and> cte_wp_at' (\<lambda>a. {frame..+2 ^ pageBits} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap a)) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap (cteCap a)) parent s \<and> valid_pspace' s \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s) \<and> cte_wp_at' (\<lambda>a. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap a)) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap (cteCap a)) parent s \<and> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap c) = capability.UntypedCap (?isdev2550 asid_base parenta slota framea rv cap) frame pageBits (max_free_index pageBits)) parent s \<and> cap = capability.UntypedCap isdev frame pageBits idx
 2. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>\<lambda>_. cte_wp_at' ((=) (capability.UntypedCap isdev frame pageBits idx) \<circ> cteCap) parent and (\<lambda>s. descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s)) and pspace_no_overlap' frame pageBits and invs' and ct_active'\<rbrace>
 3. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) parent a) \<and> frame \<noteq> 0 \<and> (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> (caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> (valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..+2 ^ pageBits} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> (valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if parent = parent then capFreeIndex_update (\<lambda>_. max_free_index pageBits) else id) c) = capability.UntypedCap (?isdev2551 asid_base parenta slota framea y rv) frame pageBits (max_free_index pageBits)) parent a) and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) s \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> {s. s \<Turnstile>\<^sub>c parenta \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<noteq> 0 \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = asid_base && mask 17, capASIDPool_CL = frame && ~~ mask 4, \<dots> = y\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame asid_base)) v)) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> 0 \<le>s ARMSmallPageBits))}}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 4. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?isdev2551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () \<equiv>\<^sup>? ?isdev2550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) ()
?isdev2553 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) (capability.UntypedCap isdev frame pageBits idx) () \<equiv>\<^sup>? ?isdev2551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (capability.UntypedCap isdev frame pageBits idx)
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (4 subgoals):
 1. \<And>s cte. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base 10; descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s); ctes_of s parent = Some cte; capability.UntypedCap isdev frame 12 idx = cteCap cte; pspace_no_overlap' frame 12 s; invs' s; ct_active' s\<rbrakk> \<Longrightarrow> isUntypedCap (cteCap cte) \<and> untyped_ranges_zero' s \<and> is_aligned 0x1000 4 \<and> isUntypedCap (cteCap cte) \<and> capFreeIndex (cteCap cte) \<le> 4096 \<and> 4096 \<le> 2 ^ capBlockSize (cteCap cte) \<and> is_aligned 0x1000 4 \<and> frame \<noteq> 0 \<and> valid_pspace' s \<and> isUntypedCap (cteCap cte) \<and> caps_no_overlap'' frame 12 s \<and> isUntypedCap (cteCap cte) \<and> base < 2 ^ local.asid_bits \<and> valid_pspace' s \<and> descendants_range_in' {frame..+4096} parent (ctes_of s) \<and> {frame..+4096} \<subseteq> untypedRange (cteCap cte) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 4096) (cteCap cte)) \<inter> {frame..+4096} = {} \<and> isUntypedCap (cteCap cte) \<and> valid_pspace' s \<and> {frame..0xFFF + frame} \<subseteq> untypedRange (cteCap cte) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 4096) (cteCap cte)) \<inter> {frame..0xFFF + frame} = {} \<and> isUntypedCap (cteCap cte) \<and> capFreeIndex_update (\<lambda>_. 4096) (cteCap cte) = capability.UntypedCap (?isdev2550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (cteCap cte)) frame 12 4096
 2. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>\<lambda>_. cte_wp_at' ((=) (capability.UntypedCap isdev frame pageBits idx) \<circ> cteCap) parent and (\<lambda>s. descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s)) and pspace_no_overlap' frame pageBits and invs' and ct_active'\<rbrace>
 3. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) parent a) \<and> frame \<noteq> 0 \<and> (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> (caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> (valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..+2 ^ pageBits} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> (valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if parent = parent then capFreeIndex_update (\<lambda>_. max_free_index pageBits) else id) c) = capability.UntypedCap (?isdev2551 asid_base parenta slota framea y rv) frame pageBits (max_free_index pageBits)) parent a) and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) s \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> {s. s \<Turnstile>\<^sub>c parenta \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<noteq> 0 \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = asid_base && mask 17, capASIDPool_CL = frame && ~~ mask 4, \<dots> = y\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame asid_base)) v)) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> 0 \<le>s ARMSmallPageBits))}}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 4. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?isdev2551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () \<equiv>\<^sup>? ?isdev2550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) ()
?isdev2553 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) (capability.UntypedCap isdev frame pageBits idx) () \<equiv>\<^sup>? ?isdev2551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (capability.UntypedCap isdev frame pageBits idx)
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (4 subgoals):
 1. \<And>s x2. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base 10; descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s); ctes_of s parent = Some (CTE (capability.UntypedCap isdev frame 12 idx) x2); pspace_no_overlap' frame 12 s; invs' s; ct_active' s\<rbrakk> \<Longrightarrow> untyped_ranges_zero' s \<and> is_aligned 0x1000 4 \<and> idx \<le> 4096 \<and> is_aligned 0x1000 4 \<and> frame \<noteq> 0 \<and> caps_no_overlap'' frame 12 s \<and> base < 2 ^ local.asid_bits \<and> descendants_range_in' {frame..+4096} parent (ctes_of s) \<and> {frame..+4096} \<subseteq> {frame..0xFFF + frame} \<and> isdev = ?isdev2550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (capability.UntypedCap isdev frame 12 idx)
 2. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>\<lambda>_. cte_wp_at' ((=) (capability.UntypedCap isdev frame pageBits idx) \<circ> cteCap) parent and (\<lambda>s. descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s)) and pspace_no_overlap' frame pageBits and invs' and ct_active'\<rbrace>
 3. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) parent a) \<and> frame \<noteq> 0 \<and> (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> (caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> (valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..+2 ^ pageBits} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> (valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if parent = parent then capFreeIndex_update (\<lambda>_. max_free_index pageBits) else id) c) = capability.UntypedCap (?isdev2551 asid_base parenta slota framea y rv) frame pageBits (max_free_index pageBits)) parent a) and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) s \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> {s. s \<Turnstile>\<^sub>c parenta \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<noteq> 0 \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = asid_base && mask 17, capASIDPool_CL = frame && ~~ mask 4, \<dots> = y\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame asid_base)) v)) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> 0 \<le>s ARMSmallPageBits))}}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 4. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?isdev2551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () \<equiv>\<^sup>? ?isdev2550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) ()
?isdev2553 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) (capability.UntypedCap isdev frame pageBits idx) () \<equiv>\<^sup>? ?isdev2551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (capability.UntypedCap isdev frame pageBits idx)
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (4 subgoals):
 1. \<And>s x2. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base 10; descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s); ctes_of s parent = Some (CTE (capability.UntypedCap isdev frame 12 idx) x2); pspace_no_overlap' frame 12 s; invs' s; ct_active' s; valid_cap' (capability.UntypedCap isdev frame 12 idx) s\<rbrakk> \<Longrightarrow> untyped_ranges_zero' s \<and> is_aligned 0x1000 4 \<and> idx \<le> 4096 \<and> is_aligned 0x1000 4 \<and> frame \<noteq> 0 \<and> caps_no_overlap'' frame 12 s \<and> base < 2 ^ local.asid_bits \<and> descendants_range_in' {frame..+4096} parent (ctes_of s) \<and> {frame..+4096} \<subseteq> {frame..0xFFF + frame} \<and> isdev = ?isdev2550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (capability.UntypedCap isdev frame 12 idx)
 2. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>\<lambda>_. cte_wp_at' ((=) (capability.UntypedCap isdev frame pageBits idx) \<circ> cteCap) parent and (\<lambda>s. descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s)) and pspace_no_overlap' frame pageBits and invs' and ct_active'\<rbrace>
 3. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) parent a) \<and> frame \<noteq> 0 \<and> (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> (caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> (valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..+2 ^ pageBits} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> (valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if parent = parent then capFreeIndex_update (\<lambda>_. max_free_index pageBits) else id) c) = capability.UntypedCap (?isdev2551 asid_base parenta slota framea y rv) frame pageBits (max_free_index pageBits)) parent a) and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) s \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> {s. s \<Turnstile>\<^sub>c parenta \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<noteq> 0 \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = asid_base && mask 17, capASIDPool_CL = frame && ~~ mask 4, \<dots> = y\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame asid_base)) v)) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> 0 \<le>s ARMSmallPageBits))}}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 4. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?isdev2551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () \<equiv>\<^sup>? ?isdev2550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) ()
?isdev2553 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) (capability.UntypedCap isdev frame pageBits idx) () \<equiv>\<^sup>? ?isdev2551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (capability.UntypedCap isdev frame pageBits idx)
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (4 subgoals):
 1. \<And>s x2. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base 10; descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s); ctes_of s parent = Some (CTE (capability.UntypedCap isdev frame 12 idx) x2); pspace_no_overlap' frame 12 s; invs' s; ct_active' s; capAligned (capability.UntypedCap isdev frame 12 idx); valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; minUntypedSizeBits \<le> 12; 12 \<le> maxUntypedSizeBits; idx \<le> 4096; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> is_aligned 0x1000 4 \<and> caps_no_overlap'' frame 12 s \<and> base < 2 ^ local.asid_bits \<and> descendants_range_in' {frame..+4096} parent (ctes_of s) \<and> {frame..+4096} \<subseteq> {frame..0xFFF + frame} \<and> isdev = ?isdev2550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (capability.UntypedCap isdev frame 12 idx)
 2. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>\<lambda>_. cte_wp_at' ((=) (capability.UntypedCap isdev frame pageBits idx) \<circ> cteCap) parent and (\<lambda>s. descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s)) and pspace_no_overlap' frame pageBits and invs' and ct_active'\<rbrace>
 3. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) parent a) \<and> frame \<noteq> 0 \<and> (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> (caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> (valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..+2 ^ pageBits} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> (valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if parent = parent then capFreeIndex_update (\<lambda>_. max_free_index pageBits) else id) c) = capability.UntypedCap (?isdev2551 asid_base parenta slota framea y rv) frame pageBits (max_free_index pageBits)) parent a) and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) s \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> {s. s \<Turnstile>\<^sub>c parenta \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<noteq> 0 \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = asid_base && mask 17, capASIDPool_CL = frame && ~~ mask 4, \<dots> = y\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame asid_base)) v)) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> 0 \<le>s ARMSmallPageBits))}}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 4. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?isdev2551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () \<equiv>\<^sup>? ?isdev2550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) ()
?isdev2553 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) (capability.UntypedCap isdev frame pageBits idx) () \<equiv>\<^sup>? ?isdev2551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (capability.UntypedCap isdev frame pageBits idx)
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (4 subgoals):
 1. \<And>s x2. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base 10; descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s); ctes_of s parent = Some (CTE (capability.UntypedCap isdev frame 12 idx) x2); pspace_no_overlap' frame 12 s; invs' s; ct_active' s; capAligned (capability.UntypedCap isdev frame 12 idx); valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; minUntypedSizeBits \<le> 12; 12 \<le> maxUntypedSizeBits; idx \<le> 4096; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> is_aligned 0x1000 4 \<and> caps_no_overlap'' frame 12 s \<and> base < 2 ^ local.asid_bits \<and> {frame..+4096} \<subseteq> {frame..0xFFF + frame} \<and> {frame..+4096} \<subseteq> {frame..0xFFF + frame} \<and> True
 2. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>\<lambda>_. cte_wp_at' ((=) (capability.UntypedCap isdev frame pageBits idx) \<circ> cteCap) parent and (\<lambda>s. descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s)) and pspace_no_overlap' frame pageBits and invs' and ct_active'\<rbrace>
 3. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) parent a) \<and> frame \<noteq> 0 \<and> (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> (caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> (valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..+2 ^ pageBits} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> (valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if parent = parent then capFreeIndex_update (\<lambda>_. max_free_index pageBits) else id) c) = capability.UntypedCap isdev frame pageBits (max_free_index pageBits)) parent a) and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) s \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> {s. s \<Turnstile>\<^sub>c parenta \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<noteq> 0 \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = asid_base && mask 17, capASIDPool_CL = frame && ~~ mask 4, \<dots> = y\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame asid_base)) v)) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> 0 \<le>s ARMSmallPageBits))}}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 4. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (4 subgoals):
 1. \<And>s x2. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base 10; descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s); ctes_of s parent = Some (CTE (capability.UntypedCap isdev frame 12 idx) x2); pspace_no_overlap' frame 12 s; invs' s; ct_active' s; capAligned (capability.UntypedCap isdev frame 12 idx); valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; minUntypedSizeBits \<le> 12; 12 \<le> maxUntypedSizeBits; idx \<le> 4096; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> is_aligned 0x1000 4 \<and> caps_no_overlap'' frame 12 s \<and> base < 2 ^ local.asid_bits \<and> {frame..+4096} \<subseteq> {frame..0xFFF + frame}
 2. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>\<lambda>_. cte_wp_at' ((=) (capability.UntypedCap isdev frame pageBits idx) \<circ> cteCap) parent and (\<lambda>s. descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s)) and pspace_no_overlap' frame pageBits and invs' and ct_active'\<rbrace>
 3. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) parent a) \<and> frame \<noteq> 0 \<and> (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> (caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> (valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..+2 ^ pageBits} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> (valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if parent = parent then capFreeIndex_update (\<lambda>_. max_free_index pageBits) else id) c) = capability.UntypedCap isdev frame pageBits (max_free_index pageBits)) parent a) and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) s \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> {s. s \<Turnstile>\<^sub>c parenta \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<noteq> 0 \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = asid_base && mask 17, capASIDPool_CL = frame && ~~ mask 4, \<dots> = y\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame asid_base)) v)) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> 0 \<le>s ARMSmallPageBits))}}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 4. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (7 subgoals):
 1. \<And>s x2. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base 10; descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s); ctes_of s parent = Some (CTE (capability.UntypedCap isdev frame 12 idx) x2); pspace_no_overlap' frame 12 s; invs' s; ct_active' s; capAligned (capability.UntypedCap isdev frame 12 idx); valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; minUntypedSizeBits \<le> 12; 12 \<le> maxUntypedSizeBits; idx \<le> 4096; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> is_aligned 0x1000 4
 2. \<And>s x2. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base 10; descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s); ctes_of s parent = Some (CTE (capability.UntypedCap isdev frame 12 idx) x2); pspace_no_overlap' frame 12 s; invs' s; ct_active' s; capAligned (capability.UntypedCap isdev frame 12 idx); valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; minUntypedSizeBits \<le> 12; 12 \<le> maxUntypedSizeBits; idx \<le> 4096; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> caps_no_overlap'' frame 12 s
 3. \<And>s x2. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base 10; descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s); ctes_of s parent = Some (CTE (capability.UntypedCap isdev frame 12 idx) x2); pspace_no_overlap' frame 12 s; invs' s; ct_active' s; capAligned (capability.UntypedCap isdev frame 12 idx); valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; minUntypedSizeBits \<le> 12; 12 \<le> maxUntypedSizeBits; idx \<le> 4096; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> base < 2 ^ local.asid_bits
 4. \<And>s x2. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base 10; descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s); ctes_of s parent = Some (CTE (capability.UntypedCap isdev frame 12 idx) x2); pspace_no_overlap' frame 12 s; invs' s; ct_active' s; capAligned (capability.UntypedCap isdev frame 12 idx); valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; minUntypedSizeBits \<le> 12; 12 \<le> maxUntypedSizeBits; idx \<le> 4096; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> {frame..+4096} \<subseteq> {frame..0xFFF + frame}
 5. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>\<lambda>_. cte_wp_at' ((=) (capability.UntypedCap isdev frame pageBits idx) \<circ> cteCap) parent and (\<lambda>s. descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s)) and pspace_no_overlap' frame pageBits and invs' and ct_active'\<rbrace>
 6. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) parent a) \<and> frame \<noteq> 0 \<and> (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> (caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> (valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..+2 ^ pageBits} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> (valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if parent = parent then capFreeIndex_update (\<lambda>_. max_free_index pageBits) else id) c) = capability.UntypedCap isdev frame pageBits (max_free_index pageBits)) parent a) and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) s \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> {s. s \<Turnstile>\<^sub>c parenta \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<noteq> 0 \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = asid_base && mask 17, capASIDPool_CL = frame && ~~ mask 4, \<dots> = y\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame asid_base)) v)) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> 0 \<le>s ARMSmallPageBits))}}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 7. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (6 subgoals):
 1. \<And>s x2. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base 10; descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s); ctes_of s parent = Some (CTE (capability.UntypedCap isdev frame 12 idx) x2); pspace_no_overlap' frame 12 s; invs' s; ct_active' s; capAligned (capability.UntypedCap isdev frame 12 idx); valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; minUntypedSizeBits \<le> 12; 12 \<le> maxUntypedSizeBits; idx \<le> 4096; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> caps_no_overlap'' frame 12 s
 2. \<And>s x2. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base 10; descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s); ctes_of s parent = Some (CTE (capability.UntypedCap isdev frame 12 idx) x2); pspace_no_overlap' frame 12 s; invs' s; ct_active' s; capAligned (capability.UntypedCap isdev frame 12 idx); valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; minUntypedSizeBits \<le> 12; 12 \<le> maxUntypedSizeBits; idx \<le> 4096; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> base < 2 ^ local.asid_bits
 3. \<And>s x2. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base 10; descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s); ctes_of s parent = Some (CTE (capability.UntypedCap isdev frame 12 idx) x2); pspace_no_overlap' frame 12 s; invs' s; ct_active' s; capAligned (capability.UntypedCap isdev frame 12 idx); valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; minUntypedSizeBits \<le> 12; 12 \<le> maxUntypedSizeBits; idx \<le> 4096; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> {frame..+4096} \<subseteq> {frame..0xFFF + frame}
 4. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>\<lambda>_. cte_wp_at' ((=) (capability.UntypedCap isdev frame pageBits idx) \<circ> cteCap) parent and (\<lambda>s. descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s)) and pspace_no_overlap' frame pageBits and invs' and ct_active'\<rbrace>
 5. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) parent a) \<and> frame \<noteq> 0 \<and> (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> (caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> (valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..+2 ^ pageBits} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> (valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if parent = parent then capFreeIndex_update (\<lambda>_. max_free_index pageBits) else id) c) = capability.UntypedCap isdev frame pageBits (max_free_index pageBits)) parent a) and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) s \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> {s. s \<Turnstile>\<^sub>c parenta \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<noteq> 0 \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = asid_base && mask 17, capASIDPool_CL = frame && ~~ mask 4, \<dots> = y\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame asid_base)) v)) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> 0 \<le>s ARMSmallPageBits))}}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 6. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (8 subgoals):
 1. \<And>s x2. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base 10; descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s); ctes_of s parent = Some (CTE (capability.UntypedCap isdev frame 12 idx) x2); pspace_no_overlap' frame 12 s; invs' s; ct_active' s; capAligned (capability.UntypedCap isdev frame 12 idx); valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; minUntypedSizeBits \<le> 12; 12 \<le> maxUntypedSizeBits; idx \<le> 4096; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> invs' s
 2. \<And>s x2. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base 10; descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s); ctes_of s parent = Some (CTE (capability.UntypedCap isdev frame 12 idx) x2); pspace_no_overlap' frame 12 s; invs' s; ct_active' s; capAligned (capability.UntypedCap isdev frame 12 idx); valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; minUntypedSizeBits \<le> 12; 12 \<le> maxUntypedSizeBits; idx \<le> 4096; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap isdev (frame && ~~ mask 12) 12 (?idx2604 s x2)) parent s
 3. \<And>s x2. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base 10; descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s); ctes_of s parent = Some (CTE (capability.UntypedCap isdev frame 12 idx) x2); pspace_no_overlap' frame 12 s; invs' s; ct_active' s; capAligned (capability.UntypedCap isdev frame 12 idx); valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; minUntypedSizeBits \<le> 12; 12 \<le> maxUntypedSizeBits; idx \<le> 4096; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> descendants_range_in' {frame..(frame && ~~ mask 12) + 2 ^ 12 - 1} parent (ctes_of s)
 4. \<And>s x2. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base 10; descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s); ctes_of s parent = Some (CTE (capability.UntypedCap isdev frame 12 idx) x2); pspace_no_overlap' frame 12 s; invs' s; ct_active' s; capAligned (capability.UntypedCap isdev frame 12 idx); valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; minUntypedSizeBits \<le> 12; 12 \<le> maxUntypedSizeBits; idx \<le> 4096; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> base < 2 ^ local.asid_bits
 5. \<And>s x2. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base 10; descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s); ctes_of s parent = Some (CTE (capability.UntypedCap isdev frame 12 idx) x2); pspace_no_overlap' frame 12 s; invs' s; ct_active' s; capAligned (capability.UntypedCap isdev frame 12 idx); valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; minUntypedSizeBits \<le> 12; 12 \<le> maxUntypedSizeBits; idx \<le> 4096; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> {frame..+4096} \<subseteq> {frame..0xFFF + frame}
 6. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>\<lambda>_. cte_wp_at' ((=) (capability.UntypedCap isdev frame pageBits idx) \<circ> cteCap) parent and (\<lambda>s. descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s)) and pspace_no_overlap' frame pageBits and invs' and ct_active'\<rbrace>
 7. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) parent a) \<and> frame \<noteq> 0 \<and> (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> (caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> (valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..+2 ^ pageBits} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> (valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if parent = parent then capFreeIndex_update (\<lambda>_. max_free_index pageBits) else id) c) = capability.UntypedCap isdev frame pageBits (max_free_index pageBits)) parent a) and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) s \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> {s. s \<Turnstile>\<^sub>c parenta \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<noteq> 0 \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = asid_base && mask 17, capASIDPool_CL = frame && ~~ mask 4, \<dots> = y\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame asid_base)) v)) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> 0 \<le>s ARMSmallPageBits))}}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 8. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (7 subgoals):
 1. \<And>s x2. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base 10; descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s); ctes_of s parent = Some (CTE (capability.UntypedCap isdev frame 12 idx) x2); pspace_no_overlap' frame 12 s; invs' s; ct_active' s; capAligned (capability.UntypedCap isdev frame 12 idx); valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; minUntypedSizeBits \<le> 12; 12 \<le> maxUntypedSizeBits; idx \<le> 4096; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap isdev (frame && ~~ mask 12) 12 (?idx2604 s x2)) parent s
 2. \<And>s x2. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base 10; descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s); ctes_of s parent = Some (CTE (capability.UntypedCap isdev frame 12 idx) x2); pspace_no_overlap' frame 12 s; invs' s; ct_active' s; capAligned (capability.UntypedCap isdev frame 12 idx); valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; minUntypedSizeBits \<le> 12; 12 \<le> maxUntypedSizeBits; idx \<le> 4096; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> descendants_range_in' {frame..(frame && ~~ mask 12) + 2 ^ 12 - 1} parent (ctes_of s)
 3. \<And>s x2. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base 10; descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s); ctes_of s parent = Some (CTE (capability.UntypedCap isdev frame 12 idx) x2); pspace_no_overlap' frame 12 s; invs' s; ct_active' s; capAligned (capability.UntypedCap isdev frame 12 idx); valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; minUntypedSizeBits \<le> 12; 12 \<le> maxUntypedSizeBits; idx \<le> 4096; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> base < 2 ^ local.asid_bits
 4. \<And>s x2. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base 10; descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s); ctes_of s parent = Some (CTE (capability.UntypedCap isdev frame 12 idx) x2); pspace_no_overlap' frame 12 s; invs' s; ct_active' s; capAligned (capability.UntypedCap isdev frame 12 idx); valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; minUntypedSizeBits \<le> 12; 12 \<le> maxUntypedSizeBits; idx \<le> 4096; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> {frame..+4096} \<subseteq> {frame..0xFFF + frame}
 5. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>\<lambda>_. cte_wp_at' ((=) (capability.UntypedCap isdev frame pageBits idx) \<circ> cteCap) parent and (\<lambda>s. descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s)) and pspace_no_overlap' frame pageBits and invs' and ct_active'\<rbrace>
 6. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) parent a) \<and> frame \<noteq> 0 \<and> (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> (caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> (valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..+2 ^ pageBits} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> (valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if parent = parent then capFreeIndex_update (\<lambda>_. max_free_index pageBits) else id) c) = capability.UntypedCap isdev frame pageBits (max_free_index pageBits)) parent a) and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) s \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> {s. s \<Turnstile>\<^sub>c parenta \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<noteq> 0 \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = asid_base && mask 17, capASIDPool_CL = frame && ~~ mask 4, \<dots> = y\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame asid_base)) v)) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> 0 \<le>s ARMSmallPageBits))}}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 7. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (6 subgoals):
 1. \<And>s x2. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base 10; descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s); ctes_of s parent = Some (CTE (capability.UntypedCap isdev frame 12 idx) x2); pspace_no_overlap' frame 12 s; invs' s; ct_active' s; capAligned (capability.UntypedCap isdev frame 12 idx); valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; minUntypedSizeBits \<le> 12; 12 \<le> maxUntypedSizeBits; idx \<le> 4096; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> descendants_range_in' {frame..(frame && ~~ mask 12) + 2 ^ 12 - 1} parent (ctes_of s)
 2. \<And>s x2. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base 10; descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s); ctes_of s parent = Some (CTE (capability.UntypedCap isdev frame 12 idx) x2); pspace_no_overlap' frame 12 s; invs' s; ct_active' s; capAligned (capability.UntypedCap isdev frame 12 idx); valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; minUntypedSizeBits \<le> 12; 12 \<le> maxUntypedSizeBits; idx \<le> 4096; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> base < 2 ^ local.asid_bits
 3. \<And>s x2. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base 10; descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s); ctes_of s parent = Some (CTE (capability.UntypedCap isdev frame 12 idx) x2); pspace_no_overlap' frame 12 s; invs' s; ct_active' s; capAligned (capability.UntypedCap isdev frame 12 idx); valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; minUntypedSizeBits \<le> 12; 12 \<le> maxUntypedSizeBits; idx \<le> 4096; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> {frame..+4096} \<subseteq> {frame..0xFFF + frame}
 4. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>\<lambda>_. cte_wp_at' ((=) (capability.UntypedCap isdev frame pageBits idx) \<circ> cteCap) parent and (\<lambda>s. descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s)) and pspace_no_overlap' frame pageBits and invs' and ct_active'\<rbrace>
 5. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) parent a) \<and> frame \<noteq> 0 \<and> (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> (caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> (valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..+2 ^ pageBits} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> (valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if parent = parent then capFreeIndex_update (\<lambda>_. max_free_index pageBits) else id) c) = capability.UntypedCap isdev frame pageBits (max_free_index pageBits)) parent a) and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) s \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> {s. s \<Turnstile>\<^sub>c parenta \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<noteq> 0 \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = asid_base && mask 17, capASIDPool_CL = frame && ~~ mask 4, \<dots> = y\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame asid_base)) v)) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> 0 \<le>s ARMSmallPageBits))}}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 6. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (5 subgoals):
 1. \<And>s x2. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base 10; descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s); ctes_of s parent = Some (CTE (capability.UntypedCap isdev frame 12 idx) x2); pspace_no_overlap' frame 12 s; invs' s; ct_active' s; capAligned (capability.UntypedCap isdev frame 12 idx); valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; minUntypedSizeBits \<le> 12; 12 \<le> maxUntypedSizeBits; idx \<le> 4096; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> base < 2 ^ local.asid_bits
 2. \<And>s x2. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base 10; descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s); ctes_of s parent = Some (CTE (capability.UntypedCap isdev frame 12 idx) x2); pspace_no_overlap' frame 12 s; invs' s; ct_active' s; capAligned (capability.UntypedCap isdev frame 12 idx); valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; minUntypedSizeBits \<le> 12; 12 \<le> maxUntypedSizeBits; idx \<le> 4096; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> {frame..+4096} \<subseteq> {frame..0xFFF + frame}
 3. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>\<lambda>_. cte_wp_at' ((=) (capability.UntypedCap isdev frame pageBits idx) \<circ> cteCap) parent and (\<lambda>s. descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s)) and pspace_no_overlap' frame pageBits and invs' and ct_active'\<rbrace>
 4. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) parent a) \<and> frame \<noteq> 0 \<and> (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> (caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> (valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..+2 ^ pageBits} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> (valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if parent = parent then capFreeIndex_update (\<lambda>_. max_free_index pageBits) else id) c) = capability.UntypedCap isdev frame pageBits (max_free_index pageBits)) parent a) and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) s \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> {s. s \<Turnstile>\<^sub>c parenta \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<noteq> 0 \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = asid_base && mask 17, capASIDPool_CL = frame && ~~ mask 4, \<dots> = y\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame asid_base)) v)) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> 0 \<le>s ARMSmallPageBits))}}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 5. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (6 subgoals):
 1. \<And>s x2. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base 10; descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s); ctes_of s parent = Some (CTE (capability.UntypedCap isdev frame 12 idx) x2); pspace_no_overlap' frame 12 s; invs' s; ct_active' s; capAligned (capability.UntypedCap isdev frame 12 idx); valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; minUntypedSizeBits \<le> 12; 12 \<le> maxUntypedSizeBits; idx \<le> 4096; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> 0 < 2 ^ local.asid_bits
 2. \<And>s x2. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base 10; descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s); ctes_of s parent = Some (CTE (capability.UntypedCap isdev frame 12 idx) x2); pspace_no_overlap' frame 12 s; invs' s; ct_active' s; capAligned (capability.UntypedCap isdev frame 12 idx); valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; minUntypedSizeBits \<le> 12; 12 \<le> maxUntypedSizeBits; idx \<le> 4096; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> base \<le> 2 ^ local.asid_bits - 1
 3. \<And>s x2. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base 10; descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s); ctes_of s parent = Some (CTE (capability.UntypedCap isdev frame 12 idx) x2); pspace_no_overlap' frame 12 s; invs' s; ct_active' s; capAligned (capability.UntypedCap isdev frame 12 idx); valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; minUntypedSizeBits \<le> 12; 12 \<le> maxUntypedSizeBits; idx \<le> 4096; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> {frame..+4096} \<subseteq> {frame..0xFFF + frame}
 4. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>\<lambda>_. cte_wp_at' ((=) (capability.UntypedCap isdev frame pageBits idx) \<circ> cteCap) parent and (\<lambda>s. descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s)) and pspace_no_overlap' frame pageBits and invs' and ct_active'\<rbrace>
 5. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) parent a) \<and> frame \<noteq> 0 \<and> (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> (caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> (valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..+2 ^ pageBits} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> (valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if parent = parent then capFreeIndex_update (\<lambda>_. max_free_index pageBits) else id) c) = capability.UntypedCap isdev frame pageBits (max_free_index pageBits)) parent a) and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) s \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> {s. s \<Turnstile>\<^sub>c parenta \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<noteq> 0 \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = asid_base && mask 17, capASIDPool_CL = frame && ~~ mask 4, \<dots> = y\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame asid_base)) v)) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> 0 \<le>s ARMSmallPageBits))}}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 6. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (5 subgoals):
 1. \<And>s x2. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base 10; descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s); ctes_of s parent = Some (CTE (capability.UntypedCap isdev frame 12 idx) x2); pspace_no_overlap' frame 12 s; invs' s; ct_active' s; capAligned (capability.UntypedCap isdev frame 12 idx); valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; minUntypedSizeBits \<le> 12; 12 \<le> maxUntypedSizeBits; idx \<le> 4096; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> base \<le> 2 ^ local.asid_bits - 1
 2. \<And>s x2. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base 10; descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s); ctes_of s parent = Some (CTE (capability.UntypedCap isdev frame 12 idx) x2); pspace_no_overlap' frame 12 s; invs' s; ct_active' s; capAligned (capability.UntypedCap isdev frame 12 idx); valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; minUntypedSizeBits \<le> 12; 12 \<le> maxUntypedSizeBits; idx \<le> 4096; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> {frame..+4096} \<subseteq> {frame..0xFFF + frame}
 3. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>\<lambda>_. cte_wp_at' ((=) (capability.UntypedCap isdev frame pageBits idx) \<circ> cteCap) parent and (\<lambda>s. descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s)) and pspace_no_overlap' frame pageBits and invs' and ct_active'\<rbrace>
 4. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) parent a) \<and> frame \<noteq> 0 \<and> (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> (caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> (valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..+2 ^ pageBits} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> (valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if parent = parent then capFreeIndex_update (\<lambda>_. max_free_index pageBits) else id) c) = capability.UntypedCap isdev frame pageBits (max_free_index pageBits)) parent a) and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) s \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> {s. s \<Turnstile>\<^sub>c parenta \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<noteq> 0 \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = asid_base && mask 17, capASIDPool_CL = frame && ~~ mask 4, \<dots> = y\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame asid_base)) v)) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> 0 \<le>s ARMSmallPageBits))}}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 5. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (4 subgoals):
 1. \<And>s x2. \<lbrakk>is_aligned frame 12; base \<le> mask local.asid_bits; is_aligned base 10; descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s); ctes_of s parent = Some (CTE (capability.UntypedCap isdev frame 12 idx) x2); pspace_no_overlap' frame 12 s; invs' s; ct_active' s; capAligned (capability.UntypedCap isdev frame 12 idx); valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; minUntypedSizeBits \<le> 12; 12 \<le> maxUntypedSizeBits; idx \<le> 4096; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> {frame..+4096} \<subseteq> {frame..0xFFF + frame}
 2. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>\<lambda>_. cte_wp_at' ((=) (capability.UntypedCap isdev frame pageBits idx) \<circ> cteCap) parent and (\<lambda>s. descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s)) and pspace_no_overlap' frame pageBits and invs' and ct_active'\<rbrace>
 3. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) parent a) \<and> frame \<noteq> 0 \<and> (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> (caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> (valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..+2 ^ pageBits} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> (valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if parent = parent then capFreeIndex_update (\<lambda>_. max_free_index pageBits) else id) c) = capability.UntypedCap isdev frame pageBits (max_free_index pageBits)) parent a) and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) s \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> {s. s \<Turnstile>\<^sub>c parenta \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<noteq> 0 \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = asid_base && mask 17, capASIDPool_CL = frame && ~~ mask 4, \<dots> = y\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame asid_base)) v)) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> 0 \<le>s ARMSmallPageBits))}}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 4. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (3 subgoals):
 1. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?R1523 asid_base parenta slota framea\<rbrace> deleteObjects frame pageBits \<lbrace>\<lambda>_. cte_wp_at' ((=) (capability.UntypedCap isdev frame pageBits idx) \<circ> cteCap) parent and (\<lambda>s. descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s)) and pspace_no_overlap' frame pageBits and invs' and ct_active'\<rbrace>
 2. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) parent a) \<and> frame \<noteq> 0 \<and> (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> (caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> (valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..+2 ^ pageBits} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> (valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if parent = parent then capFreeIndex_update (\<lambda>_. max_free_index pageBits) else id) c) = capability.UntypedCap isdev frame pageBits (max_free_index pageBits)) parent a) and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) s \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> {s. s \<Turnstile>\<^sub>c parenta \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<noteq> 0 \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = asid_base && mask 17, capASIDPool_CL = frame && ~~ mask 4, \<dots> = y\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame asid_base)) v)) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> 0 \<le>s ARMSmallPageBits))}}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 3. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and ?R1523 asid_base parenta slota framea and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (2 subgoals):
 1. \<And>asid_base parenta slota framea. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; is_aligned frame pageBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 asid_base parenta slota framea\<^esub> (?R'1523 asid_base parenta slota framea) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes (ptr_val framea) 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes (ptr_val framea) 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region (ptr_val framea) 12) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. sa \<in> ?S1570 asid_base parenta slota framea y (xfdc s) \<longrightarrow> sa \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> rv = cteCap cte) parent and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ capBlockSize rv) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) parent a) \<and> frame \<noteq> 0 \<and> (pspace_no_overlap' frame pageBits a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> (caps_no_overlap'' frame pageBits a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) parent a) \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent a \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> (valid_pspace' a \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..+2 ^ pageBits} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> (valid_pspace' a \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) parent a) \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if parent = parent then capFreeIndex_update (\<lambda>_. max_free_index pageBits) else id) c) = capability.UntypedCap isdev frame pageBits (max_free_index pageBits)) parent a) and (\<lambda>_. rv = capability.UntypedCap isdev frame pageBits idx)) s \<longrightarrow> s' \<in> {s. \<not> capIsDevice rv \<longrightarrow> region_actually_is_bytes (capPtr rv + word_of_nat (max_free_index pageBits)) (capFreeIndex rv - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex rv - max_free_index pageBits) (capPtr rv + word_of_nat (max_free_index pageBits)) = replicate (capFreeIndex rv - max_free_index pageBits) 0} \<inter> {s. s \<Turnstile>\<^sub>c parenta \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> s \<Turnstile>\<^sub>c cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(parenta\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<noteq> 0 \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = asid_base && mask 17, capASIDPool_CL = frame && ~~ mask 4, \<dots> = y\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame asid_base)) v)) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> 0 \<le>s ARMSmallPageBits))}}} \<inter> ?S1570 asid_base parenta slota framea y (xfdc s)}
 2. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and (\<lambda>s. (cte_wp_at' ((=) (capability.UntypedCap isdev frame pageBits idx) \<circ> cteCap) parent s \<and> parent \<notin> {frame..frame + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap isdev frame pageBits idx) s \<and> valid_pspace' s) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d2630 asid_base parenta slota framea) frame pageBits idx) parent and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d2630 asid_base parenta slota framea) frame pageBits idx) parent (ctes_of s)) and (\<lambda>s. descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s)) and K (pageBits < word_bits \<and> is_aligned frame pageBits)) s \<and> (valid_cap' (capability.UntypedCap (?d2632 asid_base parenta slota framea) frame pageBits (?idx2632 asid_base parenta slota framea)) and valid_pspace') s \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap isdev frame pageBits idx) parent and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap isdev frame pageBits idx) parent (ctes_of s)) and K (pageBits < word_bits \<and> is_aligned frame pageBits)) s \<and> (invs' and sch_act_simple and ct_active' and cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_range' (capability.UntypedCap isdev frame pageBits idx) parent (ctes_of s)) and K (pageBits < word_bits \<and> is_aligned frame pageBits)) s) and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>is_aligned frame pageBits; base \<le> mask local.asid_bits; is_aligned base local.asid_low_bits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1523 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)\<^esub> (?R'1523 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)));;
\<acute>globals :== ghost'state_'_update (gs_clear_region frame 12) {s. (s \<in> ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc s) \<longrightarrow> (\<exists>sa. (sa, s) \<in> rf_sr \<and> valid_objs' sa \<and> cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev frame pageBits idx = cteCap cte) parent sa \<and> untyped_ranges_zero' sa \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> invs' sa \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capFreeIndex (cteCap a) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize (cteCap a) \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) parent sa \<and> frame \<noteq> 0 \<and> pspace_no_overlap' frame pageBits sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) parent sa \<and> caps_no_overlap'' frame pageBits sa \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) parent sa \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent sa \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> base < 2 ^ local.asid_bits \<and> valid_pspace' sa \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of sa) \<and> cte_wp_at' (\<lambda>a. {frame..+2 ^ pageBits} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap a)) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap (cteCap a)) parent sa \<and> valid_pspace' sa \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of sa) \<and> cte_wp_at' (\<lambda>a. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap a)) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap (cteCap a)) parent sa \<and> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap c) = capability.UntypedCap isdev frame pageBits (max_free_index pageBits)) parent sa) \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes (frame + word_of_nat (max_free_index pageBits)) (idx - max_free_index pageBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (idx - max_free_index pageBits) (frame + word_of_nat (max_free_index pageBits)) = replicate (idx - max_free_index pageBits) 0) \<and> (s \<Turnstile>\<^sub>c cte_Ptr parent \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ((\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> cap_get_tag (cte_C.cap_C (the (cslift s (cte_Ptr parent)))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (cslift s (cte_Ptr parent))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cte_Ptr parent))))) (t_hrs_' (globals s))) \<longrightarrow> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v)) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> 0 \<le>s ARMSmallPageBits)))) \<and> s \<in> ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc s)}
 2. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and (\<lambda>s. (cte_wp_at' ((=) (capability.UntypedCap isdev frame pageBits idx) \<circ> cteCap) parent s \<and> parent \<notin> {frame..frame + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap isdev frame pageBits idx) s \<and> valid_pspace' s) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d2630 asid_base parenta slota framea) frame pageBits idx) parent and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d2630 asid_base parenta slota framea) frame pageBits idx) parent (ctes_of s)) and (\<lambda>s. descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s)) and K (pageBits < word_bits \<and> is_aligned frame pageBits)) s \<and> (valid_cap' (capability.UntypedCap (?d2632 asid_base parenta slota framea) frame pageBits (?idx2632 asid_base parenta slota framea)) and valid_pspace') s \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap isdev frame pageBits idx) parent and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap isdev frame pageBits idx) parent (ctes_of s)) and K (pageBits < word_bits \<and> is_aligned frame pageBits)) s \<and> (invs' and sch_act_simple and ct_active' and cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_range' (capability.UntypedCap isdev frame pageBits idx) parent (ctes_of s)) and K (pageBits < word_bits \<and> is_aligned frame pageBits)) s) and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> ?R'1523 asid_base parenta slota framea
flex-flex pairs:
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (1 subgoal):
 1. \<And>asid_base parenta slota framea s s'. \<lbrakk>base \<le> mask local.asid_bits \<and> is_aligned base local.asid_low_bits; asid_base = base; parenta = cte_Ptr parent; slota = cte_Ptr slot; framea = PTR(unit) frame; (s, s') \<in> rf_sr; (invs' and ct_active' and sch_act_simple and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_of' parent (ctes_of s) = {}) and ex_cte_cap_wp_to' (\<lambda>_. True) parent) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 asid_base parenta slota framea) frame pageBits (?idx1550 asid_base parenta slota framea)) (?p1549 asid_base parenta slota framea) and (\<lambda>s. descendants_range' (capability.UntypedCap (?d1547 asid_base parenta slota framea) frame pageBits (?idx1545 asid_base parenta slota framea)) (?p1543 asid_base parenta slota framea) (ctes_of s)) and invs' and ct_active' and sch_act_simple and K (2 \<le> pageBits \<and> pageBits < word_bits) and (\<lambda>s. (cte_wp_at' ((=) (capability.UntypedCap isdev frame pageBits idx) \<circ> cteCap) parent s \<and> parent \<notin> {frame..frame + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap isdev frame pageBits idx) s \<and> valid_pspace' s) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d2630 asid_base parenta slota framea) frame pageBits idx) parent and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap (?d2630 asid_base parenta slota framea) frame pageBits idx) parent (ctes_of s)) and (\<lambda>s. descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s)) and K (pageBits < word_bits \<and> is_aligned frame pageBits)) s \<and> (valid_cap' (capability.UntypedCap (?d2632 asid_base parenta slota framea) frame pageBits (?idx2632 asid_base parenta slota framea)) and valid_pspace') s \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap isdev frame pageBits idx) parent and invs' and ct_active' and sch_act_simple and (\<lambda>s. descendants_range' (capability.UntypedCap isdev frame pageBits idx) parent (ctes_of s)) and K (pageBits < word_bits \<and> is_aligned frame pageBits)) s \<and> (invs' and sch_act_simple and ct_active' and cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap isdev frame pageBits idx) parent and (\<lambda>s. descendants_range' (capability.UntypedCap isdev frame pageBits idx) parent (ctes_of s)) and K (pageBits < word_bits \<and> is_aligned frame pageBits)) s) and (\<lambda>_. is_aligned frame pageBits)) s \<and> s' \<in> UNIV \<inter> {s. htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s)))) \<longrightarrow> (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s \<in> ?S2669 asid_base parenta slota framea s \<longrightarrow> (\<exists>sa. (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s) \<in> rf_sr \<and> valid_objs' sa \<and> cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev frame pageBits idx = cteCap cte) parent sa \<and> untyped_ranges_zero' sa \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> invs' sa \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capFreeIndex (cteCap a) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize (cteCap a) \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) parent sa \<and> frame \<noteq> 0 \<and> pspace_no_overlap' frame pageBits sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) parent sa \<and> caps_no_overlap'' frame pageBits sa \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) parent sa \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent sa \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> asid_base < 2 ^ local.asid_bits \<and> valid_pspace' sa \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of sa) \<and> cte_wp_at' (\<lambda>a. {frame..+2 ^ pageBits} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap a)) \<inter> {frame..+2 ^ pageBits} = {} \<and> isUntypedCap (cteCap a)) parent sa \<and> valid_pspace' sa \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of sa) \<and> cte_wp_at' (\<lambda>a. {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap a)) \<inter> {frame..frame + 2 ^ pageBits - 1} = {} \<and> isUntypedCap (cteCap a)) parent sa \<and> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap c) = capability.UntypedCap isdev frame pageBits (max_free_index pageBits)) parent sa) \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' (frame + word_of_nat (max_free_index pageBits)) (idx - max_free_index pageBits) (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s)))) (idx - max_free_index pageBits) (frame + word_of_nat (max_free_index pageBits)) = replicate (idx - max_free_index pageBits) 0) \<and> (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s))) \<Turnstile>\<^sub>t parenta \<longrightarrow> cap_get_tag (h_val (hrs_mem (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s)))) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ((\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s)))) (cap_Ptr &(parenta\<rightarrow>[''cap_C'']))))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s)))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> cap_get_tag (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s))) parenta))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s))) parenta)))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s)))) (cap_Ptr &(parenta\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update parenta (cte_C.cap_C_update (\<lambda>_. cap) (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s))) parenta)))) (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s)))) \<longrightarrow> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> insert SIndexVal {a. SIndexTyp 0 = a} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s))) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s)))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = asid_base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<and> cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame asid_base)) v)) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> 0 \<le>s ARMSmallPageBits)))) \<and> globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s \<in> ?S2653 asid_base parenta slota framea s}
flex-flex pairs:
?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent s\<rbrakk> \<Longrightarrow> is_aligned frame pageBits \<and> 2 \<le> pageBits \<and> valid_cap' (capability.UntypedCap isdev frame pageBits idx) s \<and> descendants_range' (capability.UntypedCap isdev frame pageBits idx) parent (ctes_of s) \<and> cte_wp_at' (\<lambda>a. capability.UntypedCap isdev frame pageBits idx = cteCap a) parent s \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s) \<and> (frame \<le> parent \<longrightarrow> \<not> parent \<le> frame + 2 ^ pageBits - 1) \<and> descendants_range' (capability.UntypedCap (?d2630 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) frame pageBits idx) parent (ctes_of s) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d2630 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) frame pageBits idx) parent s \<and> valid_cap' (capability.UntypedCap (?d2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) frame pageBits (?idx2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame))) s \<and> descendants_range' (capability.UntypedCap (?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) frame pageBits (?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame))) (?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) (ctes_of s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) frame pageBits (?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame))) (?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) s \<and> (htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s')))) \<longrightarrow> globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s' \<in> ?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) s' \<and> (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s' \<in> ?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) s' \<longrightarrow> (\<exists>s. invs' s \<and> valid_objs' s \<and> valid_pspace' s \<and> frame \<noteq> 0 \<and> pspace_no_overlap' frame pageBits s \<and> caps_no_overlap'' frame pageBits s \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent s \<and> untyped_ranges_zero' s \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) parent s \<and> base < 2 ^ local.asid_bits \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of s) \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s) \<and> cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev frame pageBits idx = cteCap cte) parent s \<and> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap c) = capability.UntypedCap isdev frame pageBits (max_free_index pageBits)) parent s \<and> (s, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize (cteCap a)) parent s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {frame..+2 ^ pageBits} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap a)) \<inter> {frame..+2 ^ pageBits} = {}) parent s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap a)) \<inter> {frame..frame + 2 ^ pageBits - 1} = {}) parent s) \<longrightarrow> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s'))) (idx - max_free_index pageBits) (frame + word_of_nat (max_free_index pageBits)) = replicate (idx - max_free_index pageBits) 0 \<and> region_actually_is_bytes' (frame + word_of_nat (max_free_index pageBits)) (idx - max_free_index pageBits) (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))))) \<and> (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t cte_Ptr parent \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ((\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> cap_get_tag (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent)))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))) (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr>) \<longrightarrow> 0 \<le>s ARMSmallPageBits \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s')))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v)))))))
flex-flex pairs:
?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx) parent s; \<exists>cte. cteCap cte = capability.UntypedCap isdev frame pageBits idx \<and> valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> is_aligned frame pageBits \<and> 2 \<le> pageBits \<and> valid_cap' (capability.UntypedCap isdev frame pageBits idx) s \<and> descendants_range' (capability.UntypedCap isdev frame pageBits idx) parent (ctes_of s) \<and> cte_wp_at' (\<lambda>a. capability.UntypedCap isdev frame pageBits idx = cteCap a) parent s \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s) \<and> (frame \<le> parent \<longrightarrow> \<not> parent \<le> frame + 2 ^ pageBits - 1) \<and> descendants_range' (capability.UntypedCap (?d2630 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) frame pageBits idx) parent (ctes_of s) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d2630 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) frame pageBits idx) parent s \<and> valid_cap' (capability.UntypedCap (?d2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) frame pageBits (?idx2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame))) s \<and> descendants_range' (capability.UntypedCap (?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) frame pageBits (?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame))) (?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) (ctes_of s) \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap (?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) frame pageBits (?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame))) (?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) s \<and> (htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s')))) \<longrightarrow> globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s' \<in> ?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) s' \<and> (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s' \<in> ?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) s' \<longrightarrow> (\<exists>s. invs' s \<and> valid_objs' s \<and> valid_pspace' s \<and> frame \<noteq> 0 \<and> pspace_no_overlap' frame pageBits s \<and> caps_no_overlap'' frame pageBits s \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> cte_wp_at' (\<lambda>c. True) parent s \<and> untyped_ranges_zero' s \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) parent s \<and> base < 2 ^ local.asid_bits \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of s) \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s) \<and> cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev frame pageBits idx = cteCap cte) parent s \<and> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap c) = capability.UntypedCap isdev frame pageBits (max_free_index pageBits)) parent s \<and> (s, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize (cteCap a)) parent s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {frame..+2 ^ pageBits} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap a)) \<inter> {frame..+2 ^ pageBits} = {}) parent s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap a)) \<inter> {frame..frame + 2 ^ pageBits - 1} = {}) parent s) \<longrightarrow> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s'))) (idx - max_free_index pageBits) (frame + word_of_nat (max_free_index pageBits)) = replicate (idx - max_free_index pageBits) 0 \<and> region_actually_is_bytes' (frame + word_of_nat (max_free_index pageBits)) (idx - max_free_index pageBits) (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))))) \<and> (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t cte_Ptr parent \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ((\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> cap_get_tag (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent)))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))) (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr>) \<longrightarrow> 0 \<le>s ARMSmallPageBits \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s')))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame && ~~ mask 4\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v)))))))
flex-flex pairs:
?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> (frame \<le> parent \<longrightarrow> \<not> parent \<le> frame + 2 ^ pageBits - 1) \<and> isdev = ?d2630 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<and> valid_untyped' (?d2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) frame pageBits (?idx2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) s \<and> ?idx2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<le> 2 ^ pageBits \<and> is_aligned (word_of_nat (?idx2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame))) 4 \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} (?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) (ctes_of s) \<and> (\<exists>cte. ctes_of s (?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) = Some cte \<and> cteCap cte = capability.UntypedCap (?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) frame pageBits (?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame))) \<and> (htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s')))) \<longrightarrow> globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s' \<in> ?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) s' \<and> (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s' \<in> ?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) s' \<longrightarrow> (\<exists>s. invs' s \<and> valid_objs' s \<and> valid_pspace' s \<and> pspace_no_overlap' frame pageBits s \<and> caps_no_overlap'' frame pageBits s \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> (\<exists>cte. ctes_of s parent = Some cte) \<and> untyped_ranges_zero' s \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte)) \<and> base < 2 ^ local.asid_bits \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of s) \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev frame pageBits idx = cteCap cte) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte) = capability.UntypedCap isdev frame pageBits (max_free_index pageBits)) \<and> (s, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> capFreeIndex (cteCap cte) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize (cteCap cte)) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> {frame..+2 ^ pageBits} \<subseteq> untypedRange (cteCap cte) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte)) \<inter> {frame..+2 ^ pageBits} = {}) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap cte) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte)) \<inter> {frame..frame + 2 ^ pageBits - 1} = {})) \<longrightarrow> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s'))) (idx - max_free_index pageBits) (frame + word_of_nat (max_free_index pageBits)) = replicate (idx - max_free_index pageBits) 0 \<and> region_actually_is_bytes' (frame + word_of_nat (max_free_index pageBits)) (idx - max_free_index pageBits) (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))))) \<and> (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t cte_Ptr parent \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ((\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> cap_get_tag (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent)))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))) (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr>) \<longrightarrow> 0 \<le>s ARMSmallPageBits \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s')))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v)))))))
flex-flex pairs:
?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (7 subgoals):
 1. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> frame \<le> parent \<longrightarrow> \<not> parent \<le> frame + 2 ^ pageBits - 1
 2. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> valid_untyped' (?d2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) frame pageBits (?idx2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) s
 3. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> ?idx2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<le> 2 ^ pageBits
 4. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> is_aligned (word_of_nat (?idx2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame))) 4
 5. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} (?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) (ctes_of s)
 6. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) = Some cte \<and> cteCap cte = capability.UntypedCap (?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) frame pageBits (?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame))
 7. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s')))) \<longrightarrow> globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s' \<in> ?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) s' \<and> (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s' \<in> ?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) s' \<longrightarrow> (\<exists>s. invs' s \<and> valid_objs' s \<and> valid_pspace' s \<and> pspace_no_overlap' frame pageBits s \<and> caps_no_overlap'' frame pageBits s \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> (\<exists>cte. ctes_of s parent = Some cte) \<and> untyped_ranges_zero' s \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte)) \<and> base < 2 ^ local.asid_bits \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of s) \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev frame pageBits idx = cteCap cte) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte) = capability.UntypedCap isdev frame pageBits (max_free_index pageBits)) \<and> (s, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> capFreeIndex (cteCap cte) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize (cteCap cte)) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> {frame..+2 ^ pageBits} \<subseteq> untypedRange (cteCap cte) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte)) \<inter> {frame..+2 ^ pageBits} = {}) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap cte) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte)) \<inter> {frame..frame + 2 ^ pageBits - 1} = {})) \<longrightarrow> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s'))) (idx - max_free_index pageBits) (frame + word_of_nat (max_free_index pageBits)) = replicate (idx - max_free_index pageBits) 0 \<and> region_actually_is_bytes' (frame + word_of_nat (max_free_index pageBits)) (idx - max_free_index pageBits) (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))))) \<and> (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t cte_Ptr parent \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ((\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> cap_get_tag (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent)))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))) (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr>) \<longrightarrow> 0 \<le>s ARMSmallPageBits \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s')))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v))))))
flex-flex pairs:
?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (7 subgoals):
 1. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4; frame \<le> parent; parent \<le> frame + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> False
 2. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> valid_untyped' (?d2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) frame pageBits (?idx2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) s
 3. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> ?idx2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<le> 2 ^ pageBits
 4. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> is_aligned (word_of_nat (?idx2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame))) 4
 5. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} (?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) (ctes_of s)
 6. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) = Some cte \<and> cteCap cte = capability.UntypedCap (?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) frame pageBits (?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame))
 7. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s')))) \<longrightarrow> globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s' \<in> ?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) s' \<and> (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s' \<in> ?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) s' \<longrightarrow> (\<exists>s. invs' s \<and> valid_objs' s \<and> valid_pspace' s \<and> pspace_no_overlap' frame pageBits s \<and> caps_no_overlap'' frame pageBits s \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> (\<exists>cte. ctes_of s parent = Some cte) \<and> untyped_ranges_zero' s \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte)) \<and> base < 2 ^ local.asid_bits \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of s) \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev frame pageBits idx = cteCap cte) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte) = capability.UntypedCap isdev frame pageBits (max_free_index pageBits)) \<and> (s, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> capFreeIndex (cteCap cte) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize (cteCap cte)) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> {frame..+2 ^ pageBits} \<subseteq> untypedRange (cteCap cte) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte)) \<inter> {frame..+2 ^ pageBits} = {}) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap cte) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte)) \<inter> {frame..frame + 2 ^ pageBits - 1} = {})) \<longrightarrow> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s'))) (idx - max_free_index pageBits) (frame + word_of_nat (max_free_index pageBits)) = replicate (idx - max_free_index pageBits) 0 \<and> region_actually_is_bytes' (frame + word_of_nat (max_free_index pageBits)) (idx - max_free_index pageBits) (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))))) \<and> (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t cte_Ptr parent \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ((\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> cap_get_tag (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent)))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))) (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr>) \<longrightarrow> 0 \<le>s ARMSmallPageBits \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s')))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v))))))
flex-flex pairs:
?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (12 subgoals):
 1. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4; parent \<le> frame + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cteb. cteCap cteb = capability.UntypedCap (?d2748 s s' cte ctea) frame pageBits (?idx2748 s s' cte ctea)) (?cref2748 s s' cte ctea) (?s2748 s s' cte ctea)
 2. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4; parent \<le> frame + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> descendants_of' (?cref2748 s s' cte ctea) (ctes_of (?s2748 s s' cte ctea)) = {}
 3. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4; parent \<le> frame + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> invs' (?s2748 s s' cte ctea)
 4. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4; parent \<le> frame + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) parent (?s2748 s s' cte ctea)
 5. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4; parent \<le> frame + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> valid_global_refs' (?s2748 s s' cte ctea)
 6. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4; parent \<le> frame + 2 ^ pageBits - 1; False\<rbrakk> \<Longrightarrow> False
 7. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> valid_untyped' (?d2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) frame pageBits (?idx2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) s
 8. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> ?idx2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<le> 2 ^ pageBits
 9. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> is_aligned (word_of_nat (?idx2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame))) 4
 10. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} (?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) (ctes_of s)
A total of 12 subgoals...
flex-flex pairs:
?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (11 subgoals):
 1. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4; parent \<le> frame + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> descendants_of' parent (ctes_of s) = {}
 2. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4; parent \<le> frame + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> invs' s
 3. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4; parent \<le> frame + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) parent s
 4. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4; parent \<le> frame + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> valid_global_refs' s
 5. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4; parent \<le> frame + 2 ^ pageBits - 1; False\<rbrakk> \<Longrightarrow> False
 6. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> valid_untyped' (?d2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) frame pageBits (?idx2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) s
 7. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> ?idx2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<le> 2 ^ pageBits
 8. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> is_aligned (word_of_nat (?idx2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame))) 4
 9. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} (?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) (ctes_of s)
 10. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) = Some cte \<and> cteCap cte = capability.UntypedCap (?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) frame pageBits (?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame))
A total of 11 subgoals...
flex-flex pairs:
?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (8 subgoals):
 1. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4; parent \<le> frame + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> valid_global_refs' s
 2. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4; parent \<le> frame + 2 ^ pageBits - 1; False\<rbrakk> \<Longrightarrow> False
 3. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> valid_untyped' (?d2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) frame pageBits (?idx2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) s
 4. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> ?idx2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<le> 2 ^ pageBits
 5. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> is_aligned (word_of_nat (?idx2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame))) 4
 6. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} (?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) (ctes_of s)
 7. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) = Some cte \<and> cteCap cte = capability.UntypedCap (?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) frame pageBits (?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame))
 8. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s')))) \<longrightarrow> globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s' \<in> ?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) s' \<and> (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s' \<in> ?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) s' \<longrightarrow> (\<exists>s. invs' s \<and> valid_objs' s \<and> valid_pspace' s \<and> pspace_no_overlap' frame pageBits s \<and> caps_no_overlap'' frame pageBits s \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> (\<exists>cte. ctes_of s parent = Some cte) \<and> untyped_ranges_zero' s \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte)) \<and> base < 2 ^ local.asid_bits \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of s) \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev frame pageBits idx = cteCap cte) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte) = capability.UntypedCap isdev frame pageBits (max_free_index pageBits)) \<and> (s, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> capFreeIndex (cteCap cte) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize (cteCap cte)) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> {frame..+2 ^ pageBits} \<subseteq> untypedRange (cteCap cte) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte)) \<inter> {frame..+2 ^ pageBits} = {}) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap cte) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte)) \<inter> {frame..frame + 2 ^ pageBits - 1} = {})) \<longrightarrow> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s'))) (idx - max_free_index pageBits) (frame + word_of_nat (max_free_index pageBits)) = replicate (idx - max_free_index pageBits) 0 \<and> region_actually_is_bytes' (frame + word_of_nat (max_free_index pageBits)) (idx - max_free_index pageBits) (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))))) \<and> (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t cte_Ptr parent \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ((\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> cap_get_tag (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent)))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))) (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr>) \<longrightarrow> 0 \<le>s ARMSmallPageBits \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s')))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v))))))
flex-flex pairs:
?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (7 subgoals):
 1. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4; parent \<le> frame + 2 ^ pageBits - 1; False\<rbrakk> \<Longrightarrow> False
 2. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> valid_untyped' (?d2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) frame pageBits (?idx2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) s
 3. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> ?idx2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<le> 2 ^ pageBits
 4. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> is_aligned (word_of_nat (?idx2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame))) 4
 5. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} (?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) (ctes_of s)
 6. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) = Some cte \<and> cteCap cte = capability.UntypedCap (?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) frame pageBits (?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame))
 7. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s')))) \<longrightarrow> globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s' \<in> ?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) s' \<and> (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s' \<in> ?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) s' \<longrightarrow> (\<exists>s. invs' s \<and> valid_objs' s \<and> valid_pspace' s \<and> pspace_no_overlap' frame pageBits s \<and> caps_no_overlap'' frame pageBits s \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> (\<exists>cte. ctes_of s parent = Some cte) \<and> untyped_ranges_zero' s \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte)) \<and> base < 2 ^ local.asid_bits \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of s) \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev frame pageBits idx = cteCap cte) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte) = capability.UntypedCap isdev frame pageBits (max_free_index pageBits)) \<and> (s, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> capFreeIndex (cteCap cte) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize (cteCap cte)) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> {frame..+2 ^ pageBits} \<subseteq> untypedRange (cteCap cte) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte)) \<inter> {frame..+2 ^ pageBits} = {}) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap cte) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte)) \<inter> {frame..frame + 2 ^ pageBits - 1} = {})) \<longrightarrow> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s'))) (idx - max_free_index pageBits) (frame + word_of_nat (max_free_index pageBits)) = replicate (idx - max_free_index pageBits) 0 \<and> region_actually_is_bytes' (frame + word_of_nat (max_free_index pageBits)) (idx - max_free_index pageBits) (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))))) \<and> (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t cte_Ptr parent \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ((\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> cap_get_tag (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent)))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))) (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr>) \<longrightarrow> 0 \<le>s ARMSmallPageBits \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s')))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v))))))
flex-flex pairs:
?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (6 subgoals):
 1. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> valid_untyped' (?d2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) frame pageBits (?idx2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) s
 2. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> ?idx2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<le> 2 ^ pageBits
 3. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> is_aligned (word_of_nat (?idx2632 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame))) 4
 4. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} (?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) (ctes_of s)
 5. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) = Some cte \<and> cteCap cte = capability.UntypedCap (?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) frame pageBits (?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame))
 6. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s')))) \<longrightarrow> globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s' \<in> ?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) s' \<and> (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s' \<in> ?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) s' \<longrightarrow> (\<exists>s. invs' s \<and> valid_objs' s \<and> valid_pspace' s \<and> pspace_no_overlap' frame pageBits s \<and> caps_no_overlap'' frame pageBits s \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> (\<exists>cte. ctes_of s parent = Some cte) \<and> untyped_ranges_zero' s \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte)) \<and> base < 2 ^ local.asid_bits \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of s) \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev frame pageBits idx = cteCap cte) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte) = capability.UntypedCap isdev frame pageBits (max_free_index pageBits)) \<and> (s, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> capFreeIndex (cteCap cte) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize (cteCap cte)) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> {frame..+2 ^ pageBits} \<subseteq> untypedRange (cteCap cte) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte)) \<inter> {frame..+2 ^ pageBits} = {}) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap cte) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte)) \<inter> {frame..frame + 2 ^ pageBits - 1} = {})) \<longrightarrow> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s'))) (idx - max_free_index pageBits) (frame + word_of_nat (max_free_index pageBits)) = replicate (idx - max_free_index pageBits) 0 \<and> region_actually_is_bytes' (frame + word_of_nat (max_free_index pageBits)) (idx - max_free_index pageBits) (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))))) \<and> (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t cte_Ptr parent \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ((\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> cap_get_tag (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent)))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))) (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr>) \<longrightarrow> 0 \<le>s ARMSmallPageBits \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s')))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v))))))
flex-flex pairs:
?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (5 subgoals):
 1. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> idx \<le> 2 ^ pageBits
 2. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> is_aligned (word_of_nat idx) 4
 3. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} (?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) (ctes_of s)
 4. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) = Some cte \<and> cteCap cte = capability.UntypedCap (?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) frame pageBits (?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame))
 5. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s')))) \<longrightarrow> globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s' \<in> ?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) s' \<and> (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s' \<in> ?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) s' \<longrightarrow> (\<exists>s. invs' s \<and> valid_objs' s \<and> valid_pspace' s \<and> pspace_no_overlap' frame pageBits s \<and> caps_no_overlap'' frame pageBits s \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> (\<exists>cte. ctes_of s parent = Some cte) \<and> untyped_ranges_zero' s \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte)) \<and> base < 2 ^ local.asid_bits \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of s) \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev frame pageBits idx = cteCap cte) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte) = capability.UntypedCap isdev frame pageBits (max_free_index pageBits)) \<and> (s, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> capFreeIndex (cteCap cte) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize (cteCap cte)) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> {frame..+2 ^ pageBits} \<subseteq> untypedRange (cteCap cte) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte)) \<inter> {frame..+2 ^ pageBits} = {}) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap cte) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte)) \<inter> {frame..frame + 2 ^ pageBits - 1} = {})) \<longrightarrow> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s'))) (idx - max_free_index pageBits) (frame + word_of_nat (max_free_index pageBits)) = replicate (idx - max_free_index pageBits) 0 \<and> region_actually_is_bytes' (frame + word_of_nat (max_free_index pageBits)) (idx - max_free_index pageBits) (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))))) \<and> (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t cte_Ptr parent \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ((\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> cap_get_tag (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent)))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))) (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr>) \<longrightarrow> 0 \<le>s ARMSmallPageBits \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s')))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v))))))
flex-flex pairs:
?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (4 subgoals):
 1. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> is_aligned (word_of_nat idx) 4
 2. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} (?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) (ctes_of s)
 3. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) = Some cte \<and> cteCap cte = capability.UntypedCap (?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) frame pageBits (?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame))
 4. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s')))) \<longrightarrow> globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s' \<in> ?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) s' \<and> (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s' \<in> ?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) s' \<longrightarrow> (\<exists>s. invs' s \<and> valid_objs' s \<and> valid_pspace' s \<and> pspace_no_overlap' frame pageBits s \<and> caps_no_overlap'' frame pageBits s \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> (\<exists>cte. ctes_of s parent = Some cte) \<and> untyped_ranges_zero' s \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte)) \<and> base < 2 ^ local.asid_bits \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of s) \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev frame pageBits idx = cteCap cte) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte) = capability.UntypedCap isdev frame pageBits (max_free_index pageBits)) \<and> (s, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> capFreeIndex (cteCap cte) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize (cteCap cte)) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> {frame..+2 ^ pageBits} \<subseteq> untypedRange (cteCap cte) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte)) \<inter> {frame..+2 ^ pageBits} = {}) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap cte) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte)) \<inter> {frame..frame + 2 ^ pageBits - 1} = {})) \<longrightarrow> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s'))) (idx - max_free_index pageBits) (frame + word_of_nat (max_free_index pageBits)) = replicate (idx - max_free_index pageBits) 0 \<and> region_actually_is_bytes' (frame + word_of_nat (max_free_index pageBits)) (idx - max_free_index pageBits) (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))))) \<and> (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t cte_Ptr parent \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ((\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> cap_get_tag (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent)))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))) (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr>) \<longrightarrow> 0 \<le>s ARMSmallPageBits \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s')))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v))))))
flex-flex pairs:
?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (3 subgoals):
 1. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} (?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) (ctes_of s)
 2. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) = Some cte \<and> cteCap cte = capability.UntypedCap (?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) frame pageBits (?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame))
 3. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s')))) \<longrightarrow> globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s' \<in> ?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) s' \<and> (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s' \<in> ?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) s' \<longrightarrow> (\<exists>s. invs' s \<and> valid_objs' s \<and> valid_pspace' s \<and> pspace_no_overlap' frame pageBits s \<and> caps_no_overlap'' frame pageBits s \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> (\<exists>cte. ctes_of s parent = Some cte) \<and> untyped_ranges_zero' s \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte)) \<and> base < 2 ^ local.asid_bits \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of s) \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev frame pageBits idx = cteCap cte) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte) = capability.UntypedCap isdev frame pageBits (max_free_index pageBits)) \<and> (s, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> capFreeIndex (cteCap cte) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize (cteCap cte)) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> {frame..+2 ^ pageBits} \<subseteq> untypedRange (cteCap cte) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte)) \<inter> {frame..+2 ^ pageBits} = {}) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap cte) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte)) \<inter> {frame..frame + 2 ^ pageBits - 1} = {})) \<longrightarrow> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s'))) (idx - max_free_index pageBits) (frame + word_of_nat (max_free_index pageBits)) = replicate (idx - max_free_index pageBits) 0 \<and> region_actually_is_bytes' (frame + word_of_nat (max_free_index pageBits)) (idx - max_free_index pageBits) (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))))) \<and> (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t cte_Ptr parent \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ((\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> cap_get_tag (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent)))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))) (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr>) \<longrightarrow> 0 \<le>s ARMSmallPageBits \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s')))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v))))))
flex-flex pairs:
?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?p1549 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?p1543 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (2 subgoals):
 1. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s parent = Some cte \<and> cteCap cte = capability.UntypedCap (?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)) frame pageBits (?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame))
 2. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s')))) \<longrightarrow> globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s' \<in> ?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) s' \<and> (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s' \<in> ?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) s' \<longrightarrow> (\<exists>s. invs' s \<and> valid_objs' s \<and> valid_pspace' s \<and> pspace_no_overlap' frame pageBits s \<and> caps_no_overlap'' frame pageBits s \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> (\<exists>cte. ctes_of s parent = Some cte) \<and> untyped_ranges_zero' s \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte)) \<and> base < 2 ^ local.asid_bits \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of s) \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev frame pageBits idx = cteCap cte) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte) = capability.UntypedCap isdev frame pageBits (max_free_index pageBits)) \<and> (s, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> capFreeIndex (cteCap cte) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize (cteCap cte)) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> {frame..+2 ^ pageBits} \<subseteq> untypedRange (cteCap cte) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte)) \<inter> {frame..+2 ^ pageBits} = {}) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap cte) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte)) \<inter> {frame..frame + 2 ^ pageBits - 1} = {})) \<longrightarrow> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s'))) (idx - max_free_index pageBits) (frame + word_of_nat (max_free_index pageBits)) = replicate (idx - max_free_index pageBits) 0 \<and> region_actually_is_bytes' (frame + word_of_nat (max_free_index pageBits)) (idx - max_free_index pageBits) (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))))) \<and> (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t cte_Ptr parent \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ((\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> cap_get_tag (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent)))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))) (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr>) \<longrightarrow> 0 \<le>s ARMSmallPageBits \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s')))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v))))))
flex-flex pairs:
?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?d1551 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?d1547 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame)
?idx1550 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? ?idx1545 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte ctea. \<lbrakk>(s, s') \<in> rf_sr; is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4\<rbrakk> \<Longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s')))) \<longrightarrow> globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s' \<in> ?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) s' \<and> (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s' \<in> ?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) s' \<longrightarrow> (\<exists>s. invs' s \<and> valid_objs' s \<and> valid_pspace' s \<and> pspace_no_overlap' frame pageBits s \<and> caps_no_overlap'' frame pageBits s \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> (\<exists>cte. ctes_of s parent = Some cte) \<and> untyped_ranges_zero' s \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte)) \<and> base < 2 ^ local.asid_bits \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of s) \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev frame pageBits idx = cteCap cte) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte) = capability.UntypedCap isdev frame pageBits (max_free_index pageBits)) \<and> (s, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> capFreeIndex (cteCap cte) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize (cteCap cte)) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> {frame..+2 ^ pageBits} \<subseteq> untypedRange (cteCap cte) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte)) \<inter> {frame..+2 ^ pageBits} = {}) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap cte) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte)) \<inter> {frame..frame + 2 ^ pageBits - 1} = {})) \<longrightarrow> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s'))) (idx - max_free_index pageBits) (frame + word_of_nat (max_free_index pageBits)) = replicate (idx - max_free_index pageBits) 0 \<and> region_actually_is_bytes' (frame + word_of_nat (max_free_index pageBits)) (idx - max_free_index pageBits) (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))))) \<and> (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t cte_Ptr parent \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ((\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> cap_get_tag (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent)))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))) (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr>) \<longrightarrow> 0 \<le>s ARMSmallPageBits \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s')))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v))))))
flex-flex pairs:
?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s)) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte ctea y'. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; ctes_of s parent = Some cte; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr parent) = Some y'\<rbrakk> \<Longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s')))) \<longrightarrow> globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s' \<in> ?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) s' \<and> (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s' \<in> ?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) s' \<longrightarrow> (\<exists>s. invs' s \<and> valid_objs' s \<and> valid_pspace' s \<and> pspace_no_overlap' frame pageBits s \<and> caps_no_overlap'' frame pageBits s \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> (\<exists>cte. ctes_of s parent = Some cte) \<and> untyped_ranges_zero' s \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte)) \<and> base < 2 ^ local.asid_bits \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of s) \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev frame pageBits idx = cteCap cte) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte) = capability.UntypedCap isdev frame pageBits (max_free_index pageBits)) \<and> (s, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> capFreeIndex (cteCap cte) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize (cteCap cte)) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> {frame..+2 ^ pageBits} \<subseteq> untypedRange (cteCap cte) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte)) \<inter> {frame..+2 ^ pageBits} = {}) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap cte) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte)) \<inter> {frame..frame + 2 ^ pageBits - 1} = {})) \<longrightarrow> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s'))) (idx - max_free_index pageBits) (frame + word_of_nat (max_free_index pageBits)) = replicate (idx - max_free_index pageBits) 0 \<and> region_actually_is_bytes' (frame + word_of_nat (max_free_index pageBits)) (idx - max_free_index pageBits) (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))))) \<and> (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t cte_Ptr parent \<longrightarrow> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ((\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C'']))))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])))) - 4 < 0x20 \<longrightarrow> cap_get_tag (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent)))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))) (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr parent\<rightarrow>[''cap_C''])))) - 4) && mask 26\<rparr>) \<longrightarrow> 0 \<le>s ARMSmallPageBits \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s')))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v))))))
flex-flex pairs:
?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s)) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte ctea y'. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = capability.UntypedCap isdev frame pageBits idx; cteCap ctea = capability.UntypedCap isdev frame pageBits idx; is_aligned frame pageBits; valid_untyped' isdev frame pageBits idx s; frame \<noteq> 0; 4 \<le> pageBits; pageBits \<le> 29; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (capability.UntypedCap isdev frame pageBits idx) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))))\<rbrakk> \<Longrightarrow> globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s' \<in> ?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) s' \<and> (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s' \<in> ?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) s' \<longrightarrow> (\<exists>s. invs' s \<and> valid_objs' s \<and> valid_pspace' s \<and> pspace_no_overlap' frame pageBits s \<and> caps_no_overlap'' frame pageBits s \<and> is_aligned frame (Suc (Suc local.asid_low_bits)) \<and> (\<exists>cte. ctes_of s parent = Some cte) \<and> untyped_ranges_zero' s \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte)) \<and> base < 2 ^ local.asid_bits \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> descendants_range_in' {frame..+2 ^ pageBits} parent (ctes_of s) \<and> descendants_range_in' {frame..frame + 2 ^ pageBits - 1} parent (ctes_of s) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev frame pageBits idx = cteCap cte) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte) = capability.UntypedCap isdev frame pageBits (max_free_index pageBits)) \<and> (s, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> is_aligned (word_of_nat (max_free_index pageBits)) 4 \<and> capFreeIndex (cteCap cte) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize (cteCap cte)) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> {frame..+2 ^ pageBits} \<subseteq> untypedRange (cteCap cte) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte)) \<inter> {frame..+2 ^ pageBits} = {}) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> {frame..frame + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap cte) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap cte)) \<inter> {frame..frame + 2 ^ pageBits - 1} = {})) \<longrightarrow> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s'))) (idx - max_free_index pageBits) (frame + word_of_nat (max_free_index pageBits)) = replicate (idx - max_free_index pageBits) 0 \<and> region_actually_is_bytes' (frame + word_of_nat (max_free_index pageBits)) (idx - max_free_index pageBits) (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))))) \<and> (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t cte_Ptr parent \<longrightarrow> (\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y'))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20 \<longrightarrow> cap_get_tag (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent)))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))) (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>) \<longrightarrow> 0 \<le>s ARMSmallPageBits \<and> is_aligned frame 2 \<and> is_aligned (2 ^ unat ARMSmallPageBits) 2 \<and> region_actually_is_bytes frame (2 ^ pageBits) t \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s')))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v)))))
flex-flex pairs:
?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s)) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte ctea y'. \<lbrakk>base && mask local.asid_low_bits = 0; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = capability.UntypedCap isdev frame 12 idx; cteCap ctea = capability.UntypedCap isdev frame 12 idx; frame && mask 12 = 0; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; word_of_nat idx && mask 4 = 0; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (capability.UntypedCap isdev frame 12 idx) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))))\<rbrakk> \<Longrightarrow> globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s' \<in> ?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) s' \<and> (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s' \<in> ?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) s' \<longrightarrow> (\<exists>s. invs' s \<and> valid_objs' s \<and> valid_pspace' s \<and> pspace_no_overlap' frame 12 s \<and> caps_no_overlap'' frame 12 s \<and> frame && mask (Suc (Suc local.asid_low_bits)) = 0 \<and> (\<exists>cte. ctes_of s parent = Some cte) \<and> untyped_ranges_zero' s \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte)) \<and> base < 2 ^ local.asid_bits \<and> 0x1000 && mask 4 = 0 \<and> descendants_range_in' {frame..+4096} parent (ctes_of s) \<and> descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev frame 12 idx = cteCap cte) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> capFreeIndex_update (\<lambda>_. 4096) (cteCap cte) = capability.UntypedCap isdev frame 12 4096) \<and> (s, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> 0x1000 && mask 4 = 0 \<and> capFreeIndex (cteCap cte) \<le> 4096 \<and> 4096 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> {frame..+4096} \<subseteq> untypedRange (cteCap cte) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 4096) (cteCap cte)) \<inter> {frame..+4096} = {}) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> {frame..0xFFF + frame} \<subseteq> untypedRange (cteCap cte) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 4096) (cteCap cte)) \<inter> {frame..0xFFF + frame} = {})) \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' (frame + 0x1000) 0 (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))))) \<and> (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t cte_Ptr parent \<longrightarrow> (\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y'))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20 \<longrightarrow> cap_get_tag (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent)))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))) (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>) \<longrightarrow> 0 \<le>s ARMSmallPageBits \<and> frame && mask 2 = 0 \<and> 2 ^ unat ARMSmallPageBits && mask 2 = 0 \<and> region_actually_is_bytes frame 4096 t \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s')))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v)))))
flex-flex pairs:
?S2669 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s))
?S2653 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) \<equiv>\<^sup>? \<lambda>s. ?S1570 base (cte_Ptr parent) (cte_Ptr slot) (PTR(unit) frame) () (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s)) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte ctea y'. \<lbrakk>base && mask local.asid_low_bits = 0; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = capability.UntypedCap isdev frame 12 idx; cteCap ctea = capability.UntypedCap isdev frame 12 idx; frame && mask 12 = 0; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; word_of_nat idx && mask 4 = 0; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (capability.UntypedCap isdev frame 12 idx) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))))\<rbrakk> \<Longrightarrow> globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s' \<in> UNIV \<longrightarrow> (\<exists>s. invs' s \<and> valid_objs' s \<and> valid_pspace' s \<and> pspace_no_overlap' frame 12 s \<and> caps_no_overlap'' frame 12 s \<and> frame && mask (Suc (Suc local.asid_low_bits)) = 0 \<and> (\<exists>cte. ctes_of s parent = Some cte) \<and> untyped_ranges_zero' s \<and> Suc (Suc local.asid_low_bits) < word_bits \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte)) \<and> base < 2 ^ local.asid_bits \<and> 0x1000 && mask 4 = 0 \<and> descendants_range_in' {frame..+4096} parent (ctes_of s) \<and> descendants_range_in' {frame..0xFFF + frame} parent (ctes_of s) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev frame 12 idx = cteCap cte) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> capFreeIndex_update (\<lambda>_. 4096) (cteCap cte) = capability.UntypedCap isdev frame 12 4096) \<and> (s, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> 0x1000 && mask 4 = 0 \<and> capFreeIndex (cteCap cte) \<le> 4096 \<and> 4096 \<le> 2 ^ capBlockSize (cteCap cte)) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> {frame..+4096} \<subseteq> untypedRange (cteCap cte) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 4096) (cteCap cte)) \<inter> {frame..+4096} = {}) \<and> (\<exists>cte. ctes_of s parent = Some cte \<and> isUntypedCap (cteCap cte) \<and> {frame..0xFFF + frame} \<subseteq> untypedRange (cteCap cte) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 4096) (cteCap cte)) \<inter> {frame..0xFFF + frame} = {})) \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' (frame + 0x1000) 0 (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))))) \<and> (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t cte_Ptr parent \<longrightarrow> (\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y'))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20 \<longrightarrow> cap_get_tag (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent)))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))) (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>) \<longrightarrow> 0 \<le>s ARMSmallPageBits \<and> frame && mask 2 = 0 \<and> 2 ^ unat ARMSmallPageBits && mask 2 = 0 \<and> region_actually_is_bytes frame 4096 t \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s')))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v)))) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte ctea y' sa cteb. \<lbrakk>base && mask local.asid_low_bits = 0; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cteCap cteb; cteCap ctea = cteCap cteb; frame && mask 12 = 0; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; word_of_nat idx && mask 4 = 0; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cteCap cteb) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; frame && mask (Suc (Suc local.asid_low_bits)) = 0; untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cteCap cteb); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cteCap cteb) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cteCap cteb; ctes_of sa parent = Some cteb; 0x1000 && mask 4 = 0; {frame..+4096} \<subseteq> untypedRange (cteCap cteb); {frame..0xFFF + frame} \<subseteq> untypedRange (cteCap cteb); capFreeIndex (cteCap cteb) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cteCap cteb)\<rbrakk> \<Longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' (frame + 0x1000) 0 (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))))) \<and> (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t cte_Ptr parent \<longrightarrow> (\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y'))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20 \<longrightarrow> cap_get_tag (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent)))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))) (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>) \<longrightarrow> 0 \<le>s ARMSmallPageBits \<and> frame && mask 2 = 0 \<and> 2 ^ unat ARMSmallPageBits && mask 2 = 0 \<and> region_actually_is_bytes frame 4096 t \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s')))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v)))) proof (prove)
goal (2 subgoals):
 1. \<And>s s' cte ctea y' sa cteb. \<lbrakk>base && mask local.asid_low_bits = 0; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cteCap cteb; cteCap ctea = cteCap cteb; frame && mask 12 = 0; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; word_of_nat idx && mask 4 = 0; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cteCap cteb) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; frame && mask (Suc (Suc local.asid_low_bits)) = 0; untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cteCap cteb); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cteCap cteb) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cteCap cteb; 0x1000 && mask 4 = 0; {frame..+4096} \<subseteq> untypedRange (cteCap cteb); {frame..0xFFF + frame} \<subseteq> untypedRange (cteCap cteb); capFreeIndex (cteCap cteb) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cteCap cteb)\<rbrakk> \<Longrightarrow> (sa, ?s'2831 s s' cte ctea y' sa cteb) \<in> rf_sr
 2. \<And>s s' cte ctea y' sa cteb cte' ctel'. \<lbrakk>base && mask local.asid_low_bits = 0; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cteCap cteb; cteCap ctea = cteCap cteb; frame && mask 12 = 0; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; word_of_nat idx && mask 4 = 0; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cteCap cteb) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; frame && mask (Suc (Suc local.asid_low_bits)) = 0; untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cteCap cteb); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cteCap cteb) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cteCap cteb; 0x1000 && mask 4 = 0; {frame..+4096} \<subseteq> untypedRange (cteCap cteb); {frame..0xFFF + frame} \<subseteq> untypedRange (cteCap cteb); capFreeIndex (cteCap cteb) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cteCap cteb); ctes_of sa parent = Some (cte_to_H ctel'); cslift (?s'2831 s s' cte ctea y' sa cteb) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cteb = cte_to_H ctel'; cl_valid_cte ctel'\<rbrakk> \<Longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' (frame + 0x1000) 0 (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))))) \<and> (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t cte_Ptr parent \<longrightarrow> (\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y'))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20 \<longrightarrow> cap_get_tag (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent)))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))) (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>) \<longrightarrow> 0 \<le>s ARMSmallPageBits \<and> frame && mask 2 = 0 \<and> 2 ^ unat ARMSmallPageBits && mask 2 = 0 \<and> region_actually_is_bytes frame 4096 t \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s')))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v)))) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte ctea y' sa cteb cte' ctel'. \<lbrakk>base && mask local.asid_low_bits = 0; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cteCap cteb; cteCap ctea = cteCap cteb; frame && mask 12 = 0; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; word_of_nat idx && mask 4 = 0; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cteCap cteb) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; frame && mask (Suc (Suc local.asid_low_bits)) = 0; untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cteCap cteb); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cteCap cteb) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cteCap cteb; 0x1000 && mask 4 = 0; {frame..+4096} \<subseteq> untypedRange (cteCap cteb); {frame..0xFFF + frame} \<subseteq> untypedRange (cteCap cteb); capFreeIndex (cteCap cteb) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cteCap cteb); ctes_of sa parent = Some (cte_to_H ctel'); cslift (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s') (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cteb = cte_to_H ctel'; cl_valid_cte ctel'\<rbrakk> \<Longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' (frame + 0x1000) 0 (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))))) \<and> (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t cte_Ptr parent \<longrightarrow> (\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y'))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20 \<longrightarrow> cap_get_tag (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent)))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))) (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>) \<longrightarrow> 0 \<le>s ARMSmallPageBits \<and> frame && mask 2 = 0 \<and> 2 ^ unat ARMSmallPageBits && mask 2 = 0 \<and> region_actually_is_bytes frame 4096 t \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s')))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v)))) proof (prove)
goal (3 subgoals):
 1. \<And>s s' cte ctea y' sa cteb cte' ctel'. \<lbrakk>base && mask local.asid_low_bits = 0; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cteCap cteb; cteCap ctea = cteCap cteb; frame && mask 12 = 0; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; word_of_nat idx && mask 4 = 0; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cteCap cteb) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; frame && mask (Suc (Suc local.asid_low_bits)) = 0; untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cteCap cteb); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cteCap cteb) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cteCap cteb; 0x1000 && mask 4 = 0; {frame..+4096} \<subseteq> untypedRange (cteCap cteb); {frame..0xFFF + frame} \<subseteq> untypedRange (cteCap cteb); capFreeIndex (cteCap cteb) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cteCap cteb); ctes_of sa parent = Some (cte_to_H ctel'); cslift (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s') (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cteb = cte_to_H ctel'; cl_valid_cte ctel'\<rbrakk> \<Longrightarrow> ctes_of sa (?src2832 s s' cte ctea y' sa cteb cte' ctel') = Some (?cte2832 s s' cte ctea y' sa cteb cte' ctel')
 2. \<And>s s' cte ctea y' sa cteb cte' ctel'. \<lbrakk>base && mask local.asid_low_bits = 0; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cteCap cteb; cteCap ctea = cteCap cteb; frame && mask 12 = 0; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; word_of_nat idx && mask 4 = 0; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cteCap cteb) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; frame && mask (Suc (Suc local.asid_low_bits)) = 0; untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cteCap cteb); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cteCap cteb) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cteCap cteb; 0x1000 && mask 4 = 0; {frame..+4096} \<subseteq> untypedRange (cteCap cteb); {frame..0xFFF + frame} \<subseteq> untypedRange (cteCap cteb); capFreeIndex (cteCap cteb) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cteCap cteb); ctes_of sa parent = Some (cte_to_H ctel'); cslift (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s') (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cteb = cte_to_H ctel'; cl_valid_cte ctel'\<rbrakk> \<Longrightarrow> cslift (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s') (cte_Ptr (?src2832 s s' cte ctea y' sa cteb cte' ctel')) = Some (?cte'2832 s s' cte ctea y' sa cteb cte' ctel')
 3. \<And>s s' cte ctea y' sa cteb cte' ctel'. \<lbrakk>base && mask local.asid_low_bits = 0; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cteCap cteb; cteCap ctea = cteCap cteb; frame && mask 12 = 0; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; word_of_nat idx && mask 4 = 0; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cteCap cteb) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; frame && mask (Suc (Suc local.asid_low_bits)) = 0; untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cteCap cteb); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cteCap cteb) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cteCap cteb; 0x1000 && mask 4 = 0; {frame..+4096} \<subseteq> untypedRange (cteCap cteb); {frame..0xFFF + frame} \<subseteq> untypedRange (cteCap cteb); capFreeIndex (cteCap cteb) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cteCap cteb); ctes_of sa parent = Some (cte_to_H ctel'); cslift (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s') (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cteb = cte_to_H ctel'; cl_valid_cte ctel'; ccte_relation (?cte2832 s s' cte ctea y' sa cteb cte' ctel') (?cte'2832 s s' cte ctea y' sa cteb cte' ctel')\<rbrakk> \<Longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' (frame + 0x1000) 0 (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))))) \<and> (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t cte_Ptr parent \<longrightarrow> (\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y'))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20 \<longrightarrow> cap_get_tag (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent)))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))) (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent))))\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>) \<longrightarrow> 0 \<le>s ARMSmallPageBits \<and> frame && mask 2 = 0 \<and> 2 ^ unat ARMSmallPageBits && mask 2 = 0 \<and> region_actually_is_bytes frame 4096 t \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s')))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v)))) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte ctea y' sa cteb cte' ctel'. \<lbrakk>base && mask local.asid_low_bits = 0; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); frame && mask 12 = 0; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; word_of_nat idx && mask 4 = 0; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; frame && mask (Suc (Suc local.asid_low_bits)) = 0; untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); 0x1000 && mask 4 = 0; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cteb = cte_to_H ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'\<rbrakk> \<Longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' (frame + 0x1000) 0 (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))))) \<and> (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t cte_Ptr parent \<longrightarrow> (\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y'))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20 \<longrightarrow> cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>) \<longrightarrow> 0 \<le>s ARMSmallPageBits \<and> frame && mask 2 = 0 \<and> 2 ^ unat ARMSmallPageBits && mask 2 = 0 \<and> region_actually_is_bytes frame 4096 t \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s')))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v)))) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte ctea y' sa cte' ctel'. \<lbrakk>base && mask local.asid_low_bits = 0; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); frame && mask 12 = 0; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; word_of_nat idx && mask 4 = 0; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; frame && mask (Suc (Suc local.asid_low_bits)) = 0; untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); 0x1000 && mask 4 = 0; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'\<rbrakk> \<Longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' (frame + 0x1000) 0 (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))))) \<and> ((\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y'))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20 \<longrightarrow> cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>) \<longrightarrow> 0 \<le>s ARMSmallPageBits \<and> frame && mask 2 = 0 \<and> 2 ^ unat ARMSmallPageBits && mask 2 = 0 \<and> region_actually_is_bytes frame 4096 t \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s')))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v)))) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte ctea y' sa cte' ctel'. \<lbrakk>base && mask local.asid_low_bits = 0; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); frame && mask 12 = 0; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; word_of_nat idx && mask 4 = 0; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; frame && mask (Suc (Suc local.asid_low_bits)) = 0; untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); 0x1000 && mask 4 = 0; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cteCap (cte_to_H ctel')) (cte_C.cap_C cte')\<rbrakk> \<Longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' (frame + 0x1000) 0 (hrs_htd (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))))) \<and> ((\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y'))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20 \<longrightarrow> cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>) \<longrightarrow> 0 \<le>s ARMSmallPageBits \<and> frame && mask 2 = 0 \<and> 2 ^ unat ARMSmallPageBits && mask 2 = 0 \<and> region_actually_is_bytes frame 4096 t \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s')))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v)))) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte ctea y' sa cte' ctel'. \<lbrakk>base && mask local.asid_low_bits = 0; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); frame && mask 12 = 0; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; word_of_nat idx && mask 4 = 0; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; frame && mask (Suc (Suc local.asid_low_bits)) = 0; untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (hrs_htd_update (typ_region_bytes frame 12)) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); 0x1000 && mask 4 = 0; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte')\<rbrakk> \<Longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' (frame + 0x1000) 0 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s'))))) \<and> ((\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y'))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20 \<longrightarrow> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (hrs_htd_update (typ_region_bytes frame 12) (t_hrs_' (globals s'))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>) \<longrightarrow> 0 \<le>s ARMSmallPageBits \<and> frame && mask 2 = 0 \<and> 2 ^ unat ARMSmallPageBits && mask 2 = 0 \<and> region_actually_is_bytes frame 4096 t \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s')))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v)))) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte ctea y' sa cte' ctel'. \<lbrakk>base && mask local.asid_low_bits = 0; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); frame && mask 12 = 0; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; word_of_nat idx && mask 4 = 0; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; frame && mask (Suc (Suc local.asid_low_bits)) = 0; untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); 0x1000 && mask 4 = 0; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte')\<rbrakk> \<Longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' (frame + 0x1000) 0 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s'))))) \<and> ((\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y'))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20 \<longrightarrow> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>) \<longrightarrow> 0 \<le>s ARMSmallPageBits \<and> frame && mask 2 = 0 \<and> 2 ^ unat ARMSmallPageBits && mask 2 = 0 \<and> region_actually_is_bytes frame 4096 t \<and> frame \<le> frame + (2 ^ unat ARMSmallPageBits - 1) \<and> {frame..+unat (2 ^ unat ARMSmallPageBits)} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> 2 ^ unat ARMSmallPageBits < 2147483648 \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s'))) = 0 \<or> 2 ^ unat ARMSmallPageBits \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s')))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate (unat (2 ^ unat ARMSmallPageBits)) 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v)))) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte ctea y' sa cte' ctel'. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte')\<rbrakk> \<Longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' (frame + 0x1000) 0 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s'))))) \<and> ((\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y'))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20 \<longrightarrow> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>) \<longrightarrow> is_aligned frame 2 \<and> is_aligned 0x1000 2 \<and> region_actually_is_bytes frame 4096 t \<and> frame \<le> frame + 0xFFF \<and> {frame..+4096} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s'))) = 0 \<or> 0x1000 \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s')))) \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate 4096 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v)))) proof (prove)
goal (4 subgoals):
 1. \<And>s s' cte ctea y' sa cte' ctel' t. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte')\<rbrakk> \<Longrightarrow> (?s2838 s s' cte ctea y' sa cte' ctel', ?\<sigma>'2838 s s' cte ctea y' sa cte' ctel') \<in> rf_sr
 2. \<And>s s' cte ctea y' sa cte' ctel' t. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte')\<rbrakk> \<Longrightarrow> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals (?\<sigma>'2838 s s' cte ctea y' sa cte' ctel'))) = ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s')))
 3. \<And>s s' cte ctea y' sa cte' ctel' t. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte')\<rbrakk> \<Longrightarrow> unat 0x1000 \<le> gsMaxObjectSize (?s2838 s s' cte ctea y' sa cte' ctel')
 4. \<And>s s' cte ctea y' sa cte' ctel'. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte')\<rbrakk> \<Longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' (frame + 0x1000) 0 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s'))))) \<and> ((\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y'))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20 \<longrightarrow> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>) \<longrightarrow> is_aligned frame 2 \<and> is_aligned 0x1000 2 \<and> region_actually_is_bytes frame 4096 t \<and> frame \<le> frame + 0xFFF \<and> {frame..+4096} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> True \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate 4096 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v)))) proof (prove)
goal (3 subgoals):
 1. \<And>s s' cte ctea y' sa cte' ctel' t. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte')\<rbrakk> \<Longrightarrow> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals (globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s'))) = ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (gs_clear_region frame 12 (ghost'state_' (globals s')))
 2. \<And>s s' cte ctea y' sa cte' ctel' t. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte')\<rbrakk> \<Longrightarrow> unat 0x1000 \<le> gsMaxObjectSize sa
 3. \<And>s s' cte ctea y' sa cte' ctel'. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte')\<rbrakk> \<Longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' (frame + 0x1000) 0 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s'))))) \<and> ((\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y'))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20 \<longrightarrow> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>) \<longrightarrow> is_aligned frame 2 \<and> is_aligned 0x1000 2 \<and> region_actually_is_bytes frame 4096 t \<and> frame \<le> frame + 0xFFF \<and> {frame..+4096} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> True \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate 4096 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v)))) proof (prove)
goal (2 subgoals):
 1. \<And>s s' cte ctea y' sa cte' ctel' t. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte')\<rbrakk> \<Longrightarrow> unat 0x1000 \<le> gsMaxObjectSize sa
 2. \<And>s s' cte ctea y' sa cte' ctel'. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte')\<rbrakk> \<Longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' (frame + 0x1000) 0 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s'))))) \<and> ((\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y'))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20 \<longrightarrow> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>) \<longrightarrow> is_aligned frame 2 \<and> is_aligned 0x1000 2 \<and> region_actually_is_bytes frame 4096 t \<and> frame \<le> frame + 0xFFF \<and> {frame..+4096} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> True \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate 4096 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v)))) proof (prove)
goal (2 subgoals):
 1. \<And>s s' cte ctea y' sa cte' ctel' t. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte'); kernel_data_refs \<inter> capRange (cteCap cte) = {} \<and> global_refs' s \<subseteq> kernel_data_refs \<and> 2 ^ capBits (cteCap cte) \<le> gsMaxObjectSize s; kernel_data_refs \<inter> capRange (cteCap (cte_to_H ctel')) = {} \<and> global_refs' sa \<subseteq> kernel_data_refs \<and> 2 ^ capBits (cteCap (cte_to_H ctel')) \<le> gsMaxObjectSize sa\<rbrakk> \<Longrightarrow> unat 0x1000 \<le> gsMaxObjectSize sa
 2. \<And>s s' cte ctea y' sa cte' ctel'. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte')\<rbrakk> \<Longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' (frame + 0x1000) 0 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s'))))) \<and> ((\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y'))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20 \<longrightarrow> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>) \<longrightarrow> is_aligned frame 2 \<and> is_aligned 0x1000 2 \<and> region_actually_is_bytes frame 4096 t \<and> frame \<le> frame + 0xFFF \<and> {frame..+4096} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> True \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate 4096 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v)))) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte ctea y' sa cte' ctel'. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte')\<rbrakk> \<Longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' (frame + 0x1000) 0 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s'))))) \<and> ((\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y'))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20 \<longrightarrow> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>) \<longrightarrow> is_aligned frame 2 \<and> is_aligned 0x1000 2 \<and> region_actually_is_bytes frame 4096 t \<and> frame \<le> frame + 0xFFF \<and> {frame..+4096} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> True \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate 4096 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v)))) proof (prove)
goal (2 subgoals):
 1. \<And>s s' cte ctea y' sa cte' ctel'. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte')\<rbrakk> \<Longrightarrow> typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s'))) = typ_region_bytes frame 12 (?htd'2861 s s' cte ctea y' sa cte' ctel')
 2. \<And>s s' cte ctea y' sa cte' ctel'. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte'); region_actually_is_bytes' frame (2 ^ 12) (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s'))))\<rbrakk> \<Longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' (frame + 0x1000) 0 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s'))))) \<and> ((\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y'))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20 \<longrightarrow> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>) \<longrightarrow> is_aligned frame 2 \<and> is_aligned 0x1000 2 \<and> region_actually_is_bytes frame 4096 t \<and> frame \<le> frame + 0xFFF \<and> {frame..+4096} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> True \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate 4096 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v)))) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte ctea y' sa cte' ctel'. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte'); region_actually_is_bytes' frame (2 ^ 12) (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s'))))\<rbrakk> \<Longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' (frame + 0x1000) 0 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s'))))) \<and> ((\<exists>t. ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y'))) \<longrightarrow> capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20 \<longrightarrow> (\<forall>t. (\<exists>cap. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) \<and> cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>) \<longrightarrow> is_aligned frame 2 \<and> is_aligned 0x1000 2 \<and> region_actually_is_bytes frame 4096 t \<and> frame \<le> frame + 0xFFF \<and> {frame..+4096} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (t_hrs_' (globals t))) \<and> True \<and> ((\<exists>ta. t_hrs_' (globals ta) = hrs_mem_update (heap_update_list frame (replicate 4096 0)) (t_hrs_' (globals t))) \<longrightarrow> htd_safe domain (hrs_htd (t_hrs_' (globals t))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (t_hrs_' (globals t)))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v)))) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte ctea y' sa cte' ctel' t ta cap. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte'); region_actually_is_bytes' frame 4096 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')); capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))); cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>\<rbrakk> \<Longrightarrow> is_aligned frame 2 \<and> is_aligned 0x1000 2 \<and> region_actually_is_bytes' frame 4096 (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s'))))) \<and> frame \<le> frame + 0xFFF \<and> {frame..+4096} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s'))))) \<and> ((\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list frame (replicate 4096 0)) (hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))))) \<longrightarrow> htd_safe domain (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s'))))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v)) proof (prove)
goal (6 subgoals):
 1. \<And>s s' cte ctea y' sa cte' ctel' t ta cap. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte'); region_actually_is_bytes' frame 4096 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')); capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))); cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>\<rbrakk> \<Longrightarrow> is_aligned frame 2
 2. \<And>s s' cte ctea y' sa cte' ctel' t ta cap. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte'); region_actually_is_bytes' frame 4096 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')); capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))); cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>\<rbrakk> \<Longrightarrow> is_aligned 0x1000 2
 3. \<And>s s' cte ctea y' sa cte' ctel' t ta cap. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte'); region_actually_is_bytes' frame 4096 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')); capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))); cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>\<rbrakk> \<Longrightarrow> region_actually_is_bytes' frame 4096 (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))))
 4. \<And>s s' cte ctea y' sa cte' ctel' t ta cap. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte'); region_actually_is_bytes' frame 4096 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')); capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))); cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>\<rbrakk> \<Longrightarrow> frame \<le> frame + 0xFFF
 5. \<And>s s' cte ctea y' sa cte' ctel' t ta cap. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte'); region_actually_is_bytes' frame 4096 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')); capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))); cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>\<rbrakk> \<Longrightarrow> {frame..+4096} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))))
 6. \<And>s s' cte ctea y' sa cte' ctel' t ta cap. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte'); region_actually_is_bytes' frame 4096 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')); capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))); cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>\<rbrakk> \<Longrightarrow> (\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list frame (replicate 4096 0)) (hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))))) \<longrightarrow> htd_safe domain (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s'))))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v) proof (prove)
goal (5 subgoals):
 1. \<And>s s' cte ctea y' sa cte' ctel' t ta cap. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte'); region_actually_is_bytes' frame 4096 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')); capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))); cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>\<rbrakk> \<Longrightarrow> is_aligned 0x1000 2
 2. \<And>s s' cte ctea y' sa cte' ctel' t ta cap. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte'); region_actually_is_bytes' frame 4096 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')); capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))); cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>\<rbrakk> \<Longrightarrow> region_actually_is_bytes' frame 4096 (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))))
 3. \<And>s s' cte ctea y' sa cte' ctel' t ta cap. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte'); region_actually_is_bytes' frame 4096 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')); capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))); cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>\<rbrakk> \<Longrightarrow> frame \<le> frame + 0xFFF
 4. \<And>s s' cte ctea y' sa cte' ctel' t ta cap. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte'); region_actually_is_bytes' frame 4096 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')); capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))); cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>\<rbrakk> \<Longrightarrow> {frame..+4096} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))))
 5. \<And>s s' cte ctea y' sa cte' ctel' t ta cap. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte'); region_actually_is_bytes' frame 4096 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')); capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))); cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>\<rbrakk> \<Longrightarrow> (\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list frame (replicate 4096 0)) (hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))))) \<longrightarrow> htd_safe domain (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s'))))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v) proof (prove)
goal (4 subgoals):
 1. \<And>s s' cte ctea y' sa cte' ctel' t ta cap. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte'); region_actually_is_bytes' frame 4096 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')); capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))); cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>\<rbrakk> \<Longrightarrow> region_actually_is_bytes' frame 4096 (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))))
 2. \<And>s s' cte ctea y' sa cte' ctel' t ta cap. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte'); region_actually_is_bytes' frame 4096 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')); capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))); cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>\<rbrakk> \<Longrightarrow> frame \<le> frame + 0xFFF
 3. \<And>s s' cte ctea y' sa cte' ctel' t ta cap. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte'); region_actually_is_bytes' frame 4096 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')); capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))); cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>\<rbrakk> \<Longrightarrow> {frame..+4096} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))))
 4. \<And>s s' cte ctea y' sa cte' ctel' t ta cap. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte'); region_actually_is_bytes' frame 4096 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')); capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))); cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>\<rbrakk> \<Longrightarrow> (\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list frame (replicate 4096 0)) (hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))))) \<longrightarrow> htd_safe domain (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s'))))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v) proof (prove)
goal (3 subgoals):
 1. \<And>s s' cte ctea y' sa cte' ctel' t ta cap. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte'); region_actually_is_bytes' frame 4096 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')); capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))); cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>\<rbrakk> \<Longrightarrow> frame \<le> frame + 0xFFF
 2. \<And>s s' cte ctea y' sa cte' ctel' t ta cap. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte'); region_actually_is_bytes' frame 4096 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')); capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))); cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>\<rbrakk> \<Longrightarrow> {frame..+4096} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))))
 3. \<And>s s' cte ctea y' sa cte' ctel' t ta cap. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte'); region_actually_is_bytes' frame 4096 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')); capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))); cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>\<rbrakk> \<Longrightarrow> (\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list frame (replicate 4096 0)) (hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))))) \<longrightarrow> htd_safe domain (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s'))))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v) proof (prove)
goal (2 subgoals):
 1. \<And>s s' cte ctea y' sa cte' ctel' t ta cap. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte'); region_actually_is_bytes' frame 4096 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')); capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))); cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>\<rbrakk> \<Longrightarrow> {frame..+4096} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))))
 2. \<And>s s' cte ctea y' sa cte' ctel' t ta cap. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte'); region_actually_is_bytes' frame 4096 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')); capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))); cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>\<rbrakk> \<Longrightarrow> (\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list frame (replicate 4096 0)) (hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))))) \<longrightarrow> htd_safe domain (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s'))))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v) proof (prove)
goal (2 subgoals):
 1. \<And>s s' cte ctea y' sa cte' ctel' t ta cap. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte'); ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')); capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))); cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>; {frame..+4096} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s'))))\<rbrakk> \<Longrightarrow> {frame..+4096} \<times> {SIndexVal, SIndexTyp 0} \<subseteq> dom_s (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))))
 2. \<And>s s' cte ctea y' sa cte' ctel' t ta cap. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte'); region_actually_is_bytes' frame 4096 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')); capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))); cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>\<rbrakk> \<Longrightarrow> (\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list frame (replicate 4096 0)) (hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))))) \<longrightarrow> htd_safe domain (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s'))))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte ctea y' sa cte' ctel' t ta cap. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C y'); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; ccap_relation (cap_to_H (cap_CL ctel')) (cte_C.cap_C cte'); region_actually_is_bytes' frame 4096 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')); capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))); cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>\<rbrakk> \<Longrightarrow> (\<exists>t. t_hrs_' (globals t) = hrs_mem_update (heap_update_list frame (replicate 4096 0)) (hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))))) \<longrightarrow> htd_safe domain (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s'))))) \<and> htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))))) \<longrightarrow> (\<forall>v. cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<and> cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr> \<longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) v) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte ctea y' sa cte' ctel' t ta cap tb v. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; c_valid_cap (cte_C.cap_C cte'); region_actually_is_bytes' frame 4096 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')); capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))); cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>; Some (cap_to_H (cap_CL ctel')) = map_option cap_to_H (cap_lift (cte_C.cap_C y')); c_valid_cap (cte_C.cap_C y'); t_hrs_' (globals tb) = hrs_mem_update (heap_update_list frame (replicate 4096 0)) (hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s'))))); htd_safe domain (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s'))))); htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))))); cap_get_tag v = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap; cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr>\<rbrakk> \<Longrightarrow> Some (capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base)) = map_option cap_to_H (cap_lift v) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte ctea y' sa cte' ctel' t ta cap tb v. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = cap_to_H (cap_CL ctel'); cteCap ctea = cap_to_H (cap_CL ctel'); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (cap_to_H (cap_CL ctel')); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (cap_to_H (cap_CL ctel')) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = cap_to_H (cap_CL ctel'); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); {frame..0xFFF + frame} \<subseteq> untypedRange (cap_to_H (cap_CL ctel')); capFreeIndex (cap_to_H (cap_CL ctel')) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (cap_to_H (cap_CL ctel')); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; c_valid_cap (cte_C.cap_C cte'); region_actually_is_bytes' frame 4096 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')); capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))); cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>; Some (cap_to_H (cap_CL ctel')) = map_option cap_to_H (cap_lift (cte_C.cap_C y')); c_valid_cap (cte_C.cap_C y'); t_hrs_' (globals tb) = hrs_mem_update (heap_update_list frame (replicate 4096 0)) (hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s'))))); htd_safe domain (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s'))))); htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))))); cap_lift v = Some (Cap_asid_pool_cap \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr>); cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr>\<rbrakk> \<Longrightarrow> capability.ArchObjectCap (arch_capability.ASIDPoolCap frame base) = cap_to_H (Cap_asid_pool_cap \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr>) proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte ctea y' sa cte' ctel' t ta cap tb v. \<lbrakk>is_aligned base local.asid_low_bits; base \<le> mask local.asid_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = (case cap_CL ctel' of Cap_null_cap \<Rightarrow> capability.NullCap | Cap_untyped_cap uc \<Rightarrow> capability.UntypedCap (to_bool (capIsDevice_CL uc)) (capPtr_CL uc) (unat (capBlockSize_CL uc)) (unat (capFreeIndex_CL uc << 4)) | Cap_endpoint_cap ec \<Rightarrow> capability.EndpointCap (capEPPtr_CL ec) (capEPBadge_CL ec) (to_bool (capCanSend_CL ec)) (to_bool (capCanReceive_CL ec)) (to_bool (capCanGrant_CL ec)) (to_bool (capCanGrantReply_CL ec)) | Cap_notification_cap ntfn \<Rightarrow> capability.NotificationCap (capNtfnPtr_CL ntfn) (capNtfnBadge_CL ntfn) (to_bool (capNtfnCanSend_CL ntfn)) (to_bool (capNtfnCanReceive_CL ntfn)) | Cap_reply_cap rc \<Rightarrow> capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL rc))) (to_bool (capReplyMaster_CL rc)) (to_bool (capReplyCanGrant_CL rc)) | Cap_cnode_cap ccap \<Rightarrow> capability.CNodeCap (capCNodePtr_CL ccap) (unat (capCNodeRadix_CL ccap)) (capCNodeGuard_CL ccap) (unat (capCNodeGuardSize_CL ccap)) | Cap_thread_cap tc \<Rightarrow> capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL tc))) | Cap_small_frame_cap sfc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL sfc)) (cap_small_frame_cap_CL.capFBasePtr_CL sfc) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL sfc)) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc, cap_small_frame_cap_CL.capFMappedAddress_CL sfc))) | Cap_frame_cap fc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL fc)) (cap_frame_cap_CL.capFBasePtr_CL fc) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL fc)) (framesize_to_H (capFSize_CL fc)) (if cap_frame_cap_CL.capFMappedASIDHigh_CL fc = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL fc = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL fc << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL fc, cap_frame_cap_CL.capFMappedAddress_CL fc))) | Cap_asid_pool_cap apc \<Rightarrow> capability.ArchObjectCap (arch_capability.ASIDPoolCap (capASIDPool_CL apc) (capASIDBase_CL apc)) | Cap_page_table_cap ptc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageTableCap (capPTBasePtr_CL ptc) (if to_bool (capPTIsMapped_CL ptc) then Some (capPTMappedASID_CL ptc, capPTMappedAddress_CL ptc) else None)) | Cap_page_directory_cap pdf \<Rightarrow> capability.ArchObjectCap (arch_capability.PageDirectoryCap (capPDBasePtr_CL pdf) (if to_bool (capPDIsMapped_CL pdf) then Some (capPDMappedASID_CL pdf) else None)) | Cap_asid_control_cap \<Rightarrow> capability.ArchObjectCap arch_capability.ASIDControlCap | Cap_irq_control_cap \<Rightarrow> capability.IRQControlCap | Cap_irq_handler_cap ihc \<Rightarrow> capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL ihc)) | Cap_zombie_cap zc \<Rightarrow> if isZombieTCB_C (capZombieType_CL zc) then capability.Zombie (capZombieID_CL zc && ~~ mask 5) ZombieTCB (unat (capZombieID_CL zc && mask 5)) else let radix = unat (capZombieType_CL zc) in capability.Zombie (capZombieID_CL zc && ~~ mask (radix + 1)) (ZombieCNode radix) (unat (capZombieID_CL zc && mask (radix + 1))) | Cap_domain_cap \<Rightarrow> capability.DomainCap); cteCap ctea = (case cap_CL ctel' of Cap_null_cap \<Rightarrow> capability.NullCap | Cap_untyped_cap uc \<Rightarrow> capability.UntypedCap (to_bool (capIsDevice_CL uc)) (capPtr_CL uc) (unat (capBlockSize_CL uc)) (unat (capFreeIndex_CL uc << 4)) | Cap_endpoint_cap ec \<Rightarrow> capability.EndpointCap (capEPPtr_CL ec) (capEPBadge_CL ec) (to_bool (capCanSend_CL ec)) (to_bool (capCanReceive_CL ec)) (to_bool (capCanGrant_CL ec)) (to_bool (capCanGrantReply_CL ec)) | Cap_notification_cap ntfn \<Rightarrow> capability.NotificationCap (capNtfnPtr_CL ntfn) (capNtfnBadge_CL ntfn) (to_bool (capNtfnCanSend_CL ntfn)) (to_bool (capNtfnCanReceive_CL ntfn)) | Cap_reply_cap rc \<Rightarrow> capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL rc))) (to_bool (capReplyMaster_CL rc)) (to_bool (capReplyCanGrant_CL rc)) | Cap_cnode_cap ccap \<Rightarrow> capability.CNodeCap (capCNodePtr_CL ccap) (unat (capCNodeRadix_CL ccap)) (capCNodeGuard_CL ccap) (unat (capCNodeGuardSize_CL ccap)) | Cap_thread_cap tc \<Rightarrow> capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL tc))) | Cap_small_frame_cap sfc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL sfc)) (cap_small_frame_cap_CL.capFBasePtr_CL sfc) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL sfc)) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc, cap_small_frame_cap_CL.capFMappedAddress_CL sfc))) | Cap_frame_cap fc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL fc)) (cap_frame_cap_CL.capFBasePtr_CL fc) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL fc)) (framesize_to_H (capFSize_CL fc)) (if cap_frame_cap_CL.capFMappedASIDHigh_CL fc = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL fc = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL fc << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL fc, cap_frame_cap_CL.capFMappedAddress_CL fc))) | Cap_asid_pool_cap apc \<Rightarrow> capability.ArchObjectCap (arch_capability.ASIDPoolCap (capASIDPool_CL apc) (capASIDBase_CL apc)) | Cap_page_table_cap ptc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageTableCap (capPTBasePtr_CL ptc) (if to_bool (capPTIsMapped_CL ptc) then Some (capPTMappedASID_CL ptc, capPTMappedAddress_CL ptc) else None)) | Cap_page_directory_cap pdf \<Rightarrow> capability.ArchObjectCap (arch_capability.PageDirectoryCap (capPDBasePtr_CL pdf) (if to_bool (capPDIsMapped_CL pdf) then Some (capPDMappedASID_CL pdf) else None)) | Cap_asid_control_cap \<Rightarrow> capability.ArchObjectCap arch_capability.ASIDControlCap | Cap_irq_control_cap \<Rightarrow> capability.IRQControlCap | Cap_irq_handler_cap ihc \<Rightarrow> capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL ihc)) | Cap_zombie_cap zc \<Rightarrow> if isZombieTCB_C (capZombieType_CL zc) then capability.Zombie (capZombieID_CL zc && ~~ mask 5) ZombieTCB (unat (capZombieID_CL zc && mask 5)) else let radix = unat (capZombieType_CL zc) in capability.Zombie (capZombieID_CL zc && ~~ mask (radix + 1)) (ZombieCNode radix) (unat (capZombieID_CL zc && mask (radix + 1))) | Cap_domain_cap \<Rightarrow> capability.DomainCap); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (case cap_CL ctel' of Cap_null_cap \<Rightarrow> capability.NullCap | Cap_untyped_cap uc \<Rightarrow> capability.UntypedCap (to_bool (capIsDevice_CL uc)) (capPtr_CL uc) (unat (capBlockSize_CL uc)) (unat (capFreeIndex_CL uc << 4)) | Cap_endpoint_cap ec \<Rightarrow> capability.EndpointCap (capEPPtr_CL ec) (capEPBadge_CL ec) (to_bool (capCanSend_CL ec)) (to_bool (capCanReceive_CL ec)) (to_bool (capCanGrant_CL ec)) (to_bool (capCanGrantReply_CL ec)) | Cap_notification_cap ntfn \<Rightarrow> capability.NotificationCap (capNtfnPtr_CL ntfn) (capNtfnBadge_CL ntfn) (to_bool (capNtfnCanSend_CL ntfn)) (to_bool (capNtfnCanReceive_CL ntfn)) | Cap_reply_cap rc \<Rightarrow> capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL rc))) (to_bool (capReplyMaster_CL rc)) (to_bool (capReplyCanGrant_CL rc)) | Cap_cnode_cap ccap \<Rightarrow> capability.CNodeCap (capCNodePtr_CL ccap) (unat (capCNodeRadix_CL ccap)) (capCNodeGuard_CL ccap) (unat (capCNodeGuardSize_CL ccap)) | Cap_thread_cap tc \<Rightarrow> capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL tc))) | Cap_small_frame_cap sfc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL sfc)) (cap_small_frame_cap_CL.capFBasePtr_CL sfc) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL sfc)) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc, cap_small_frame_cap_CL.capFMappedAddress_CL sfc))) | Cap_frame_cap fc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL fc)) (cap_frame_cap_CL.capFBasePtr_CL fc) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL fc)) (framesize_to_H (capFSize_CL fc)) (if cap_frame_cap_CL.capFMappedASIDHigh_CL fc = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL fc = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL fc << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL fc, cap_frame_cap_CL.capFMappedAddress_CL fc))) | Cap_asid_pool_cap apc \<Rightarrow> capability.ArchObjectCap (arch_capability.ASIDPoolCap (capASIDPool_CL apc) (capASIDBase_CL apc)) | Cap_page_table_cap ptc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageTableCap (capPTBasePtr_CL ptc) (if to_bool (capPTIsMapped_CL ptc) then Some (capPTMappedASID_CL ptc, capPTMappedAddress_CL ptc) else None)) | Cap_page_directory_cap pdf \<Rightarrow> capability.ArchObjectCap (arch_capability.PageDirectoryCap (capPDBasePtr_CL pdf) (if to_bool (capPDIsMapped_CL pdf) then Some (capPDMappedASID_CL pdf) else None)) | Cap_asid_control_cap \<Rightarrow> capability.ArchObjectCap arch_capability.ASIDControlCap | Cap_irq_control_cap \<Rightarrow> capability.IRQControlCap | Cap_irq_handler_cap ihc \<Rightarrow> capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL ihc)) | Cap_zombie_cap zc \<Rightarrow> if isZombieTCB_C (capZombieType_CL zc) then capability.Zombie (capZombieID_CL zc && ~~ mask 5) ZombieTCB (unat (capZombieID_CL zc && mask 5)) else let radix = unat (capZombieType_CL zc) in capability.Zombie (capZombieID_CL zc && ~~ mask (radix + 1)) (ZombieCNode radix) (unat (capZombieID_CL zc && mask (radix + 1))) | Cap_domain_cap \<Rightarrow> capability.DomainCap); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (case cap_CL ctel' of Cap_null_cap \<Rightarrow> capability.NullCap | Cap_untyped_cap uc \<Rightarrow> capability.UntypedCap (to_bool (capIsDevice_CL uc)) (capPtr_CL uc) (unat (capBlockSize_CL uc)) (unat (capFreeIndex_CL uc << 4)) | Cap_endpoint_cap ec \<Rightarrow> capability.EndpointCap (capEPPtr_CL ec) (capEPBadge_CL ec) (to_bool (capCanSend_CL ec)) (to_bool (capCanReceive_CL ec)) (to_bool (capCanGrant_CL ec)) (to_bool (capCanGrantReply_CL ec)) | Cap_notification_cap ntfn \<Rightarrow> capability.NotificationCap (capNtfnPtr_CL ntfn) (capNtfnBadge_CL ntfn) (to_bool (capNtfnCanSend_CL ntfn)) (to_bool (capNtfnCanReceive_CL ntfn)) | Cap_reply_cap rc \<Rightarrow> capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL rc))) (to_bool (capReplyMaster_CL rc)) (to_bool (capReplyCanGrant_CL rc)) | Cap_cnode_cap ccap \<Rightarrow> capability.CNodeCap (capCNodePtr_CL ccap) (unat (capCNodeRadix_CL ccap)) (capCNodeGuard_CL ccap) (unat (capCNodeGuardSize_CL ccap)) | Cap_thread_cap tc \<Rightarrow> capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL tc))) | Cap_small_frame_cap sfc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL sfc)) (cap_small_frame_cap_CL.capFBasePtr_CL sfc) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL sfc)) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc, cap_small_frame_cap_CL.capFMappedAddress_CL sfc))) | Cap_frame_cap fc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL fc)) (cap_frame_cap_CL.capFBasePtr_CL fc) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL fc)) (framesize_to_H (capFSize_CL fc)) (if cap_frame_cap_CL.capFMappedASIDHigh_CL fc = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL fc = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL fc << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL fc, cap_frame_cap_CL.capFMappedAddress_CL fc))) | Cap_asid_pool_cap apc \<Rightarrow> capability.ArchObjectCap (arch_capability.ASIDPoolCap (capASIDPool_CL apc) (capASIDBase_CL apc)) | Cap_page_table_cap ptc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageTableCap (capPTBasePtr_CL ptc) (if to_bool (capPTIsMapped_CL ptc) then Some (capPTMappedASID_CL ptc, capPTMappedAddress_CL ptc) else None)) | Cap_page_directory_cap pdf \<Rightarrow> capability.ArchObjectCap (arch_capability.PageDirectoryCap (capPDBasePtr_CL pdf) (if to_bool (capPDIsMapped_CL pdf) then Some (capPDMappedASID_CL pdf) else None)) | Cap_asid_control_cap \<Rightarrow> capability.ArchObjectCap arch_capability.ASIDControlCap | Cap_irq_control_cap \<Rightarrow> capability.IRQControlCap | Cap_irq_handler_cap ihc \<Rightarrow> capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL ihc)) | Cap_zombie_cap zc \<Rightarrow> if isZombieTCB_C (capZombieType_CL zc) then capability.Zombie (capZombieID_CL zc && ~~ mask 5) ZombieTCB (unat (capZombieID_CL zc && mask 5)) else let radix = unat (capZombieType_CL zc) in capability.Zombie (capZombieID_CL zc && ~~ mask (radix + 1)) (ZombieCNode radix) (unat (capZombieID_CL zc && mask (radix + 1))) | Cap_domain_cap \<Rightarrow> capability.DomainCap) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = (case cap_CL ctel' of Cap_null_cap \<Rightarrow> capability.NullCap | Cap_untyped_cap uc \<Rightarrow> capability.UntypedCap (to_bool (capIsDevice_CL uc)) (capPtr_CL uc) (unat (capBlockSize_CL uc)) (unat (capFreeIndex_CL uc << 4)) | Cap_endpoint_cap ec \<Rightarrow> capability.EndpointCap (capEPPtr_CL ec) (capEPBadge_CL ec) (to_bool (capCanSend_CL ec)) (to_bool (capCanReceive_CL ec)) (to_bool (capCanGrant_CL ec)) (to_bool (capCanGrantReply_CL ec)) | Cap_notification_cap ntfn \<Rightarrow> capability.NotificationCap (capNtfnPtr_CL ntfn) (capNtfnBadge_CL ntfn) (to_bool (capNtfnCanSend_CL ntfn)) (to_bool (capNtfnCanReceive_CL ntfn)) | Cap_reply_cap rc \<Rightarrow> capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL rc))) (to_bool (capReplyMaster_CL rc)) (to_bool (capReplyCanGrant_CL rc)) | Cap_cnode_cap ccap \<Rightarrow> capability.CNodeCap (capCNodePtr_CL ccap) (unat (capCNodeRadix_CL ccap)) (capCNodeGuard_CL ccap) (unat (capCNodeGuardSize_CL ccap)) | Cap_thread_cap tc \<Rightarrow> capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL tc))) | Cap_small_frame_cap sfc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL sfc)) (cap_small_frame_cap_CL.capFBasePtr_CL sfc) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL sfc)) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc, cap_small_frame_cap_CL.capFMappedAddress_CL sfc))) | Cap_frame_cap fc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL fc)) (cap_frame_cap_CL.capFBasePtr_CL fc) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL fc)) (framesize_to_H (capFSize_CL fc)) (if cap_frame_cap_CL.capFMappedASIDHigh_CL fc = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL fc = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL fc << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL fc, cap_frame_cap_CL.capFMappedAddress_CL fc))) | Cap_asid_pool_cap apc \<Rightarrow> capability.ArchObjectCap (arch_capability.ASIDPoolCap (capASIDPool_CL apc) (capASIDBase_CL apc)) | Cap_page_table_cap ptc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageTableCap (capPTBasePtr_CL ptc) (if to_bool (capPTIsMapped_CL ptc) then Some (capPTMappedASID_CL ptc, capPTMappedAddress_CL ptc) else None)) | Cap_page_directory_cap pdf \<Rightarrow> capability.ArchObjectCap (arch_capability.PageDirectoryCap (capPDBasePtr_CL pdf) (if to_bool (capPDIsMapped_CL pdf) then Some (capPDMappedASID_CL pdf) else None)) | Cap_asid_control_cap \<Rightarrow> capability.ArchObjectCap arch_capability.ASIDControlCap | Cap_irq_control_cap \<Rightarrow> capability.IRQControlCap | Cap_irq_handler_cap ihc \<Rightarrow> capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL ihc)) | Cap_zombie_cap zc \<Rightarrow> if isZombieTCB_C (capZombieType_CL zc) then capability.Zombie (capZombieID_CL zc && ~~ mask 5) ZombieTCB (unat (capZombieID_CL zc && mask 5)) else let radix = unat (capZombieType_CL zc) in capability.Zombie (capZombieID_CL zc && ~~ mask (radix + 1)) (ZombieCNode radix) (unat (capZombieID_CL zc && mask (radix + 1))) | Cap_domain_cap \<Rightarrow> capability.DomainCap); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (case cap_CL ctel' of Cap_null_cap \<Rightarrow> capability.NullCap | Cap_untyped_cap uc \<Rightarrow> capability.UntypedCap (to_bool (capIsDevice_CL uc)) (capPtr_CL uc) (unat (capBlockSize_CL uc)) (unat (capFreeIndex_CL uc << 4)) | Cap_endpoint_cap ec \<Rightarrow> capability.EndpointCap (capEPPtr_CL ec) (capEPBadge_CL ec) (to_bool (capCanSend_CL ec)) (to_bool (capCanReceive_CL ec)) (to_bool (capCanGrant_CL ec)) (to_bool (capCanGrantReply_CL ec)) | Cap_notification_cap ntfn \<Rightarrow> capability.NotificationCap (capNtfnPtr_CL ntfn) (capNtfnBadge_CL ntfn) (to_bool (capNtfnCanSend_CL ntfn)) (to_bool (capNtfnCanReceive_CL ntfn)) | Cap_reply_cap rc \<Rightarrow> capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL rc))) (to_bool (capReplyMaster_CL rc)) (to_bool (capReplyCanGrant_CL rc)) | Cap_cnode_cap ccap \<Rightarrow> capability.CNodeCap (capCNodePtr_CL ccap) (unat (capCNodeRadix_CL ccap)) (capCNodeGuard_CL ccap) (unat (capCNodeGuardSize_CL ccap)) | Cap_thread_cap tc \<Rightarrow> capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL tc))) | Cap_small_frame_cap sfc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL sfc)) (cap_small_frame_cap_CL.capFBasePtr_CL sfc) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL sfc)) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc, cap_small_frame_cap_CL.capFMappedAddress_CL sfc))) | Cap_frame_cap fc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL fc)) (cap_frame_cap_CL.capFBasePtr_CL fc) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL fc)) (framesize_to_H (capFSize_CL fc)) (if cap_frame_cap_CL.capFMappedASIDHigh_CL fc = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL fc = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL fc << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL fc, cap_frame_cap_CL.capFMappedAddress_CL fc))) | Cap_asid_pool_cap apc \<Rightarrow> capability.ArchObjectCap (arch_capability.ASIDPoolCap (capASIDPool_CL apc) (capASIDBase_CL apc)) | Cap_page_table_cap ptc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageTableCap (capPTBasePtr_CL ptc) (if to_bool (capPTIsMapped_CL ptc) then Some (capPTMappedASID_CL ptc, capPTMappedAddress_CL ptc) else None)) | Cap_page_directory_cap pdf \<Rightarrow> capability.ArchObjectCap (arch_capability.PageDirectoryCap (capPDBasePtr_CL pdf) (if to_bool (capPDIsMapped_CL pdf) then Some (capPDMappedASID_CL pdf) else None)) | Cap_asid_control_cap \<Rightarrow> capability.ArchObjectCap arch_capability.ASIDControlCap | Cap_irq_control_cap \<Rightarrow> capability.IRQControlCap | Cap_irq_handler_cap ihc \<Rightarrow> capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL ihc)) | Cap_zombie_cap zc \<Rightarrow> if isZombieTCB_C (capZombieType_CL zc) then capability.Zombie (capZombieID_CL zc && ~~ mask 5) ZombieTCB (unat (capZombieID_CL zc && mask 5)) else let radix = unat (capZombieType_CL zc) in capability.Zombie (capZombieID_CL zc && ~~ mask (radix + 1)) (ZombieCNode radix) (unat (capZombieID_CL zc && mask (radix + 1))) | Cap_domain_cap \<Rightarrow> capability.DomainCap); {frame..0xFFF + frame} \<subseteq> untypedRange (case cap_CL ctel' of Cap_null_cap \<Rightarrow> capability.NullCap | Cap_untyped_cap uc \<Rightarrow> capability.UntypedCap (to_bool (capIsDevice_CL uc)) (capPtr_CL uc) (unat (capBlockSize_CL uc)) (unat (capFreeIndex_CL uc << 4)) | Cap_endpoint_cap ec \<Rightarrow> capability.EndpointCap (capEPPtr_CL ec) (capEPBadge_CL ec) (to_bool (capCanSend_CL ec)) (to_bool (capCanReceive_CL ec)) (to_bool (capCanGrant_CL ec)) (to_bool (capCanGrantReply_CL ec)) | Cap_notification_cap ntfn \<Rightarrow> capability.NotificationCap (capNtfnPtr_CL ntfn) (capNtfnBadge_CL ntfn) (to_bool (capNtfnCanSend_CL ntfn)) (to_bool (capNtfnCanReceive_CL ntfn)) | Cap_reply_cap rc \<Rightarrow> capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL rc))) (to_bool (capReplyMaster_CL rc)) (to_bool (capReplyCanGrant_CL rc)) | Cap_cnode_cap ccap \<Rightarrow> capability.CNodeCap (capCNodePtr_CL ccap) (unat (capCNodeRadix_CL ccap)) (capCNodeGuard_CL ccap) (unat (capCNodeGuardSize_CL ccap)) | Cap_thread_cap tc \<Rightarrow> capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL tc))) | Cap_small_frame_cap sfc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL sfc)) (cap_small_frame_cap_CL.capFBasePtr_CL sfc) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL sfc)) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc, cap_small_frame_cap_CL.capFMappedAddress_CL sfc))) | Cap_frame_cap fc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL fc)) (cap_frame_cap_CL.capFBasePtr_CL fc) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL fc)) (framesize_to_H (capFSize_CL fc)) (if cap_frame_cap_CL.capFMappedASIDHigh_CL fc = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL fc = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL fc << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL fc, cap_frame_cap_CL.capFMappedAddress_CL fc))) | Cap_asid_pool_cap apc \<Rightarrow> capability.ArchObjectCap (arch_capability.ASIDPoolCap (capASIDPool_CL apc) (capASIDBase_CL apc)) | Cap_page_table_cap ptc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageTableCap (capPTBasePtr_CL ptc) (if to_bool (capPTIsMapped_CL ptc) then Some (capPTMappedASID_CL ptc, capPTMappedAddress_CL ptc) else None)) | Cap_page_directory_cap pdf \<Rightarrow> capability.ArchObjectCap (arch_capability.PageDirectoryCap (capPDBasePtr_CL pdf) (if to_bool (capPDIsMapped_CL pdf) then Some (capPDMappedASID_CL pdf) else None)) | Cap_asid_control_cap \<Rightarrow> capability.ArchObjectCap arch_capability.ASIDControlCap | Cap_irq_control_cap \<Rightarrow> capability.IRQControlCap | Cap_irq_handler_cap ihc \<Rightarrow> capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL ihc)) | Cap_zombie_cap zc \<Rightarrow> if isZombieTCB_C (capZombieType_CL zc) then capability.Zombie (capZombieID_CL zc && ~~ mask 5) ZombieTCB (unat (capZombieID_CL zc && mask 5)) else let radix = unat (capZombieType_CL zc) in capability.Zombie (capZombieID_CL zc && ~~ mask (radix + 1)) (ZombieCNode radix) (unat (capZombieID_CL zc && mask (radix + 1))) | Cap_domain_cap \<Rightarrow> capability.DomainCap); capFreeIndex (case cap_CL ctel' of Cap_null_cap \<Rightarrow> capability.NullCap | Cap_untyped_cap uc \<Rightarrow> capability.UntypedCap (to_bool (capIsDevice_CL uc)) (capPtr_CL uc) (unat (capBlockSize_CL uc)) (unat (capFreeIndex_CL uc << 4)) | Cap_endpoint_cap ec \<Rightarrow> capability.EndpointCap (capEPPtr_CL ec) (capEPBadge_CL ec) (to_bool (capCanSend_CL ec)) (to_bool (capCanReceive_CL ec)) (to_bool (capCanGrant_CL ec)) (to_bool (capCanGrantReply_CL ec)) | Cap_notification_cap ntfn \<Rightarrow> capability.NotificationCap (capNtfnPtr_CL ntfn) (capNtfnBadge_CL ntfn) (to_bool (capNtfnCanSend_CL ntfn)) (to_bool (capNtfnCanReceive_CL ntfn)) | Cap_reply_cap rc \<Rightarrow> capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL rc))) (to_bool (capReplyMaster_CL rc)) (to_bool (capReplyCanGrant_CL rc)) | Cap_cnode_cap ccap \<Rightarrow> capability.CNodeCap (capCNodePtr_CL ccap) (unat (capCNodeRadix_CL ccap)) (capCNodeGuard_CL ccap) (unat (capCNodeGuardSize_CL ccap)) | Cap_thread_cap tc \<Rightarrow> capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL tc))) | Cap_small_frame_cap sfc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL sfc)) (cap_small_frame_cap_CL.capFBasePtr_CL sfc) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL sfc)) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc, cap_small_frame_cap_CL.capFMappedAddress_CL sfc))) | Cap_frame_cap fc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL fc)) (cap_frame_cap_CL.capFBasePtr_CL fc) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL fc)) (framesize_to_H (capFSize_CL fc)) (if cap_frame_cap_CL.capFMappedASIDHigh_CL fc = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL fc = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL fc << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL fc, cap_frame_cap_CL.capFMappedAddress_CL fc))) | Cap_asid_pool_cap apc \<Rightarrow> capability.ArchObjectCap (arch_capability.ASIDPoolCap (capASIDPool_CL apc) (capASIDBase_CL apc)) | Cap_page_table_cap ptc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageTableCap (capPTBasePtr_CL ptc) (if to_bool (capPTIsMapped_CL ptc) then Some (capPTMappedASID_CL ptc, capPTMappedAddress_CL ptc) else None)) | Cap_page_directory_cap pdf \<Rightarrow> capability.ArchObjectCap (arch_capability.PageDirectoryCap (capPDBasePtr_CL pdf) (if to_bool (capPDIsMapped_CL pdf) then Some (capPDMappedASID_CL pdf) else None)) | Cap_asid_control_cap \<Rightarrow> capability.ArchObjectCap arch_capability.ASIDControlCap | Cap_irq_control_cap \<Rightarrow> capability.IRQControlCap | Cap_irq_handler_cap ihc \<Rightarrow> capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL ihc)) | Cap_zombie_cap zc \<Rightarrow> if isZombieTCB_C (capZombieType_CL zc) then capability.Zombie (capZombieID_CL zc && ~~ mask 5) ZombieTCB (unat (capZombieID_CL zc && mask 5)) else let radix = unat (capZombieType_CL zc) in capability.Zombie (capZombieID_CL zc && ~~ mask (radix + 1)) (ZombieCNode radix) (unat (capZombieID_CL zc && mask (radix + 1))) | Cap_domain_cap \<Rightarrow> capability.DomainCap) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (case cap_CL ctel' of Cap_null_cap \<Rightarrow> capability.NullCap | Cap_untyped_cap uc \<Rightarrow> capability.UntypedCap (to_bool (capIsDevice_CL uc)) (capPtr_CL uc) (unat (capBlockSize_CL uc)) (unat (capFreeIndex_CL uc << 4)) | Cap_endpoint_cap ec \<Rightarrow> capability.EndpointCap (capEPPtr_CL ec) (capEPBadge_CL ec) (to_bool (capCanSend_CL ec)) (to_bool (capCanReceive_CL ec)) (to_bool (capCanGrant_CL ec)) (to_bool (capCanGrantReply_CL ec)) | Cap_notification_cap ntfn \<Rightarrow> capability.NotificationCap (capNtfnPtr_CL ntfn) (capNtfnBadge_CL ntfn) (to_bool (capNtfnCanSend_CL ntfn)) (to_bool (capNtfnCanReceive_CL ntfn)) | Cap_reply_cap rc \<Rightarrow> capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL rc))) (to_bool (capReplyMaster_CL rc)) (to_bool (capReplyCanGrant_CL rc)) | Cap_cnode_cap ccap \<Rightarrow> capability.CNodeCap (capCNodePtr_CL ccap) (unat (capCNodeRadix_CL ccap)) (capCNodeGuard_CL ccap) (unat (capCNodeGuardSize_CL ccap)) | Cap_thread_cap tc \<Rightarrow> capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL tc))) | Cap_small_frame_cap sfc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL sfc)) (cap_small_frame_cap_CL.capFBasePtr_CL sfc) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL sfc)) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc, cap_small_frame_cap_CL.capFMappedAddress_CL sfc))) | Cap_frame_cap fc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL fc)) (cap_frame_cap_CL.capFBasePtr_CL fc) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL fc)) (framesize_to_H (capFSize_CL fc)) (if cap_frame_cap_CL.capFMappedASIDHigh_CL fc = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL fc = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL fc << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL fc, cap_frame_cap_CL.capFMappedAddress_CL fc))) | Cap_asid_pool_cap apc \<Rightarrow> capability.ArchObjectCap (arch_capability.ASIDPoolCap (capASIDPool_CL apc) (capASIDBase_CL apc)) | Cap_page_table_cap ptc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageTableCap (capPTBasePtr_CL ptc) (if to_bool (capPTIsMapped_CL ptc) then Some (capPTMappedASID_CL ptc, capPTMappedAddress_CL ptc) else None)) | Cap_page_directory_cap pdf \<Rightarrow> capability.ArchObjectCap (arch_capability.PageDirectoryCap (capPDBasePtr_CL pdf) (if to_bool (capPDIsMapped_CL pdf) then Some (capPDMappedASID_CL pdf) else None)) | Cap_asid_control_cap \<Rightarrow> capability.ArchObjectCap arch_capability.ASIDControlCap | Cap_irq_control_cap \<Rightarrow> capability.IRQControlCap | Cap_irq_handler_cap ihc \<Rightarrow> capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL ihc)) | Cap_zombie_cap zc \<Rightarrow> if isZombieTCB_C (capZombieType_CL zc) then capability.Zombie (capZombieID_CL zc && ~~ mask 5) ZombieTCB (unat (capZombieID_CL zc && mask 5)) else let radix = unat (capZombieType_CL zc) in capability.Zombie (capZombieID_CL zc && ~~ mask (radix + 1)) (ZombieCNode radix) (unat (capZombieID_CL zc && mask (radix + 1))) | Cap_domain_cap \<Rightarrow> capability.DomainCap); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; c_valid_cap (cte_C.cap_C cte'); region_actually_is_bytes' frame 4096 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')); capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))); cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>; Some (case cap_CL ctel' of Cap_null_cap \<Rightarrow> capability.NullCap | Cap_untyped_cap uc \<Rightarrow> capability.UntypedCap (to_bool (capIsDevice_CL uc)) (capPtr_CL uc) (unat (capBlockSize_CL uc)) (unat (capFreeIndex_CL uc << 4)) | Cap_endpoint_cap ec \<Rightarrow> capability.EndpointCap (capEPPtr_CL ec) (capEPBadge_CL ec) (to_bool (capCanSend_CL ec)) (to_bool (capCanReceive_CL ec)) (to_bool (capCanGrant_CL ec)) (to_bool (capCanGrantReply_CL ec)) | Cap_notification_cap ntfn \<Rightarrow> capability.NotificationCap (capNtfnPtr_CL ntfn) (capNtfnBadge_CL ntfn) (to_bool (capNtfnCanSend_CL ntfn)) (to_bool (capNtfnCanReceive_CL ntfn)) | Cap_reply_cap rc \<Rightarrow> capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL rc))) (to_bool (capReplyMaster_CL rc)) (to_bool (capReplyCanGrant_CL rc)) | Cap_cnode_cap ccap \<Rightarrow> capability.CNodeCap (capCNodePtr_CL ccap) (unat (capCNodeRadix_CL ccap)) (capCNodeGuard_CL ccap) (unat (capCNodeGuardSize_CL ccap)) | Cap_thread_cap tc \<Rightarrow> capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL tc))) | Cap_small_frame_cap sfc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL sfc)) (cap_small_frame_cap_CL.capFBasePtr_CL sfc) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL sfc)) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc, cap_small_frame_cap_CL.capFMappedAddress_CL sfc))) | Cap_frame_cap fc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL fc)) (cap_frame_cap_CL.capFBasePtr_CL fc) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL fc)) (framesize_to_H (capFSize_CL fc)) (if cap_frame_cap_CL.capFMappedASIDHigh_CL fc = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL fc = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL fc << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL fc, cap_frame_cap_CL.capFMappedAddress_CL fc))) | Cap_asid_pool_cap apc \<Rightarrow> capability.ArchObjectCap (arch_capability.ASIDPoolCap (capASIDPool_CL apc) (capASIDBase_CL apc)) | Cap_page_table_cap ptc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageTableCap (capPTBasePtr_CL ptc) (if to_bool (capPTIsMapped_CL ptc) then Some (capPTMappedASID_CL ptc, capPTMappedAddress_CL ptc) else None)) | Cap_page_directory_cap pdf \<Rightarrow> capability.ArchObjectCap (arch_capability.PageDirectoryCap (capPDBasePtr_CL pdf) (if to_bool (capPDIsMapped_CL pdf) then Some (capPDMappedASID_CL pdf) else None)) | Cap_asid_control_cap \<Rightarrow> capability.ArchObjectCap arch_capability.ASIDControlCap | Cap_irq_control_cap \<Rightarrow> capability.IRQControlCap | Cap_irq_handler_cap ihc \<Rightarrow> capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL ihc)) | Cap_zombie_cap zc \<Rightarrow> if isZombieTCB_C (capZombieType_CL zc) then capability.Zombie (capZombieID_CL zc && ~~ mask 5) ZombieTCB (unat (capZombieID_CL zc && mask 5)) else let radix = unat (capZombieType_CL zc) in capability.Zombie (capZombieID_CL zc && ~~ mask (radix + 1)) (ZombieCNode radix) (unat (capZombieID_CL zc && mask (radix + 1))) | Cap_domain_cap \<Rightarrow> capability.DomainCap) = map_option cap_to_H (cap_lift (cte_C.cap_C y')); c_valid_cap (cte_C.cap_C y'); t_hrs_' (globals tb) = hrs_mem_update (heap_update_list frame (replicate 4096 0)) (hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s'))))); htd_safe domain (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s'))))); htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))))); cap_lift v = Some (Cap_asid_pool_cap \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr>); cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr>\<rbrakk> \<Longrightarrow> base = base && mask 17 proof (prove)
goal (1 subgoal):
 1. \<And>s s' cte ctea y' sa cte' ctel' t ta cap tb v. \<lbrakk>is_aligned base local.asid_low_bits; invs' s; sch_act_simple s; ex_cte_cap_wp_to' (\<lambda>_. True) parent s; descendants_of' parent (ctes_of s) = {}; ct_active' s; cteCap cte = (case cap_CL ctel' of Cap_null_cap \<Rightarrow> capability.NullCap | Cap_untyped_cap uc \<Rightarrow> capability.UntypedCap (to_bool (capIsDevice_CL uc)) (capPtr_CL uc) (unat (capBlockSize_CL uc)) (unat (capFreeIndex_CL uc << 4)) | Cap_endpoint_cap ec \<Rightarrow> capability.EndpointCap (capEPPtr_CL ec) (capEPBadge_CL ec) (to_bool (capCanSend_CL ec)) (to_bool (capCanReceive_CL ec)) (to_bool (capCanGrant_CL ec)) (to_bool (capCanGrantReply_CL ec)) | Cap_notification_cap ntfn \<Rightarrow> capability.NotificationCap (capNtfnPtr_CL ntfn) (capNtfnBadge_CL ntfn) (to_bool (capNtfnCanSend_CL ntfn)) (to_bool (capNtfnCanReceive_CL ntfn)) | Cap_reply_cap rc \<Rightarrow> capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL rc))) (to_bool (capReplyMaster_CL rc)) (to_bool (capReplyCanGrant_CL rc)) | Cap_cnode_cap ccap \<Rightarrow> capability.CNodeCap (capCNodePtr_CL ccap) (unat (capCNodeRadix_CL ccap)) (capCNodeGuard_CL ccap) (unat (capCNodeGuardSize_CL ccap)) | Cap_thread_cap tc \<Rightarrow> capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL tc))) | Cap_small_frame_cap sfc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL sfc)) (cap_small_frame_cap_CL.capFBasePtr_CL sfc) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL sfc)) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc, cap_small_frame_cap_CL.capFMappedAddress_CL sfc))) | Cap_frame_cap fc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL fc)) (cap_frame_cap_CL.capFBasePtr_CL fc) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL fc)) (framesize_to_H (capFSize_CL fc)) (if cap_frame_cap_CL.capFMappedASIDHigh_CL fc = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL fc = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL fc << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL fc, cap_frame_cap_CL.capFMappedAddress_CL fc))) | Cap_asid_pool_cap apc \<Rightarrow> capability.ArchObjectCap (arch_capability.ASIDPoolCap (capASIDPool_CL apc) (capASIDBase_CL apc)) | Cap_page_table_cap ptc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageTableCap (capPTBasePtr_CL ptc) (if to_bool (capPTIsMapped_CL ptc) then Some (capPTMappedASID_CL ptc, capPTMappedAddress_CL ptc) else None)) | Cap_page_directory_cap pdf \<Rightarrow> capability.ArchObjectCap (arch_capability.PageDirectoryCap (capPDBasePtr_CL pdf) (if to_bool (capPDIsMapped_CL pdf) then Some (capPDMappedASID_CL pdf) else None)) | Cap_asid_control_cap \<Rightarrow> capability.ArchObjectCap arch_capability.ASIDControlCap | Cap_irq_control_cap \<Rightarrow> capability.IRQControlCap | Cap_irq_handler_cap ihc \<Rightarrow> capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL ihc)) | Cap_zombie_cap zc \<Rightarrow> if isZombieTCB_C (capZombieType_CL zc) then capability.Zombie (capZombieID_CL zc && ~~ mask 5) ZombieTCB (unat (capZombieID_CL zc && mask 5)) else let radix = unat (capZombieType_CL zc) in capability.Zombie (capZombieID_CL zc && ~~ mask (radix + 1)) (ZombieCNode radix) (unat (capZombieID_CL zc && mask (radix + 1))) | Cap_domain_cap \<Rightarrow> capability.DomainCap); cteCap ctea = (case cap_CL ctel' of Cap_null_cap \<Rightarrow> capability.NullCap | Cap_untyped_cap uc \<Rightarrow> capability.UntypedCap (to_bool (capIsDevice_CL uc)) (capPtr_CL uc) (unat (capBlockSize_CL uc)) (unat (capFreeIndex_CL uc << 4)) | Cap_endpoint_cap ec \<Rightarrow> capability.EndpointCap (capEPPtr_CL ec) (capEPBadge_CL ec) (to_bool (capCanSend_CL ec)) (to_bool (capCanReceive_CL ec)) (to_bool (capCanGrant_CL ec)) (to_bool (capCanGrantReply_CL ec)) | Cap_notification_cap ntfn \<Rightarrow> capability.NotificationCap (capNtfnPtr_CL ntfn) (capNtfnBadge_CL ntfn) (to_bool (capNtfnCanSend_CL ntfn)) (to_bool (capNtfnCanReceive_CL ntfn)) | Cap_reply_cap rc \<Rightarrow> capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL rc))) (to_bool (capReplyMaster_CL rc)) (to_bool (capReplyCanGrant_CL rc)) | Cap_cnode_cap ccap \<Rightarrow> capability.CNodeCap (capCNodePtr_CL ccap) (unat (capCNodeRadix_CL ccap)) (capCNodeGuard_CL ccap) (unat (capCNodeGuardSize_CL ccap)) | Cap_thread_cap tc \<Rightarrow> capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL tc))) | Cap_small_frame_cap sfc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL sfc)) (cap_small_frame_cap_CL.capFBasePtr_CL sfc) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL sfc)) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc, cap_small_frame_cap_CL.capFMappedAddress_CL sfc))) | Cap_frame_cap fc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL fc)) (cap_frame_cap_CL.capFBasePtr_CL fc) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL fc)) (framesize_to_H (capFSize_CL fc)) (if cap_frame_cap_CL.capFMappedASIDHigh_CL fc = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL fc = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL fc << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL fc, cap_frame_cap_CL.capFMappedAddress_CL fc))) | Cap_asid_pool_cap apc \<Rightarrow> capability.ArchObjectCap (arch_capability.ASIDPoolCap (capASIDPool_CL apc) (capASIDBase_CL apc)) | Cap_page_table_cap ptc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageTableCap (capPTBasePtr_CL ptc) (if to_bool (capPTIsMapped_CL ptc) then Some (capPTMappedASID_CL ptc, capPTMappedAddress_CL ptc) else None)) | Cap_page_directory_cap pdf \<Rightarrow> capability.ArchObjectCap (arch_capability.PageDirectoryCap (capPDBasePtr_CL pdf) (if to_bool (capPDIsMapped_CL pdf) then Some (capPDMappedASID_CL pdf) else None)) | Cap_asid_control_cap \<Rightarrow> capability.ArchObjectCap arch_capability.ASIDControlCap | Cap_irq_control_cap \<Rightarrow> capability.IRQControlCap | Cap_irq_handler_cap ihc \<Rightarrow> capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL ihc)) | Cap_zombie_cap zc \<Rightarrow> if isZombieTCB_C (capZombieType_CL zc) then capability.Zombie (capZombieID_CL zc && ~~ mask 5) ZombieTCB (unat (capZombieID_CL zc && mask 5)) else let radix = unat (capZombieType_CL zc) in capability.Zombie (capZombieID_CL zc && ~~ mask (radix + 1)) (ZombieCNode radix) (unat (capZombieID_CL zc && mask (radix + 1))) | Cap_domain_cap \<Rightarrow> capability.DomainCap); is_aligned frame 12; valid_untyped' isdev frame 12 idx s; frame \<noteq> 0; idx \<le> 4096; is_aligned (word_of_nat idx) 4; ctes_of s parent = Some cte; cslift s' (cte_Ptr parent) = Some y'; htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); invs' sa; valid_objs' sa; valid_pspace' sa; pspace_no_overlap' frame 12 sa; caps_no_overlap'' frame 12 sa; is_aligned frame (Suc (Suc local.asid_low_bits)); untyped_ranges_zero' sa; Suc (Suc local.asid_low_bits) < word_bits; base < 2 ^ local.asid_bits; isUntypedCap (case cap_CL ctel' of Cap_null_cap \<Rightarrow> capability.NullCap | Cap_untyped_cap uc \<Rightarrow> capability.UntypedCap (to_bool (capIsDevice_CL uc)) (capPtr_CL uc) (unat (capBlockSize_CL uc)) (unat (capFreeIndex_CL uc << 4)) | Cap_endpoint_cap ec \<Rightarrow> capability.EndpointCap (capEPPtr_CL ec) (capEPBadge_CL ec) (to_bool (capCanSend_CL ec)) (to_bool (capCanReceive_CL ec)) (to_bool (capCanGrant_CL ec)) (to_bool (capCanGrantReply_CL ec)) | Cap_notification_cap ntfn \<Rightarrow> capability.NotificationCap (capNtfnPtr_CL ntfn) (capNtfnBadge_CL ntfn) (to_bool (capNtfnCanSend_CL ntfn)) (to_bool (capNtfnCanReceive_CL ntfn)) | Cap_reply_cap rc \<Rightarrow> capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL rc))) (to_bool (capReplyMaster_CL rc)) (to_bool (capReplyCanGrant_CL rc)) | Cap_cnode_cap ccap \<Rightarrow> capability.CNodeCap (capCNodePtr_CL ccap) (unat (capCNodeRadix_CL ccap)) (capCNodeGuard_CL ccap) (unat (capCNodeGuardSize_CL ccap)) | Cap_thread_cap tc \<Rightarrow> capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL tc))) | Cap_small_frame_cap sfc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL sfc)) (cap_small_frame_cap_CL.capFBasePtr_CL sfc) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL sfc)) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc, cap_small_frame_cap_CL.capFMappedAddress_CL sfc))) | Cap_frame_cap fc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL fc)) (cap_frame_cap_CL.capFBasePtr_CL fc) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL fc)) (framesize_to_H (capFSize_CL fc)) (if cap_frame_cap_CL.capFMappedASIDHigh_CL fc = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL fc = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL fc << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL fc, cap_frame_cap_CL.capFMappedAddress_CL fc))) | Cap_asid_pool_cap apc \<Rightarrow> capability.ArchObjectCap (arch_capability.ASIDPoolCap (capASIDPool_CL apc) (capASIDBase_CL apc)) | Cap_page_table_cap ptc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageTableCap (capPTBasePtr_CL ptc) (if to_bool (capPTIsMapped_CL ptc) then Some (capPTMappedASID_CL ptc, capPTMappedAddress_CL ptc) else None)) | Cap_page_directory_cap pdf \<Rightarrow> capability.ArchObjectCap (arch_capability.PageDirectoryCap (capPDBasePtr_CL pdf) (if to_bool (capPDIsMapped_CL pdf) then Some (capPDMappedASID_CL pdf) else None)) | Cap_asid_control_cap \<Rightarrow> capability.ArchObjectCap arch_capability.ASIDControlCap | Cap_irq_control_cap \<Rightarrow> capability.IRQControlCap | Cap_irq_handler_cap ihc \<Rightarrow> capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL ihc)) | Cap_zombie_cap zc \<Rightarrow> if isZombieTCB_C (capZombieType_CL zc) then capability.Zombie (capZombieID_CL zc && ~~ mask 5) ZombieTCB (unat (capZombieID_CL zc && mask 5)) else let radix = unat (capZombieType_CL zc) in capability.Zombie (capZombieID_CL zc && ~~ mask (radix + 1)) (ZombieCNode radix) (unat (capZombieID_CL zc && mask (radix + 1))) | Cap_domain_cap \<Rightarrow> capability.DomainCap); descendants_range_in' {frame..+4096} parent (ctes_of sa); descendants_range_in' {frame..0xFFF + frame} parent (ctes_of sa); (sa, globals_update (\<lambda>x. ghost'state_'_update (gs_clear_region frame 12) (t_hrs_'_update (\<lambda>p. (fst p, typ_region_bytes frame 12 (snd p))) x)) s') \<in> rf_sr; capFreeIndex_update (\<lambda>_. 4096) (case cap_CL ctel' of Cap_null_cap \<Rightarrow> capability.NullCap | Cap_untyped_cap uc \<Rightarrow> capability.UntypedCap (to_bool (capIsDevice_CL uc)) (capPtr_CL uc) (unat (capBlockSize_CL uc)) (unat (capFreeIndex_CL uc << 4)) | Cap_endpoint_cap ec \<Rightarrow> capability.EndpointCap (capEPPtr_CL ec) (capEPBadge_CL ec) (to_bool (capCanSend_CL ec)) (to_bool (capCanReceive_CL ec)) (to_bool (capCanGrant_CL ec)) (to_bool (capCanGrantReply_CL ec)) | Cap_notification_cap ntfn \<Rightarrow> capability.NotificationCap (capNtfnPtr_CL ntfn) (capNtfnBadge_CL ntfn) (to_bool (capNtfnCanSend_CL ntfn)) (to_bool (capNtfnCanReceive_CL ntfn)) | Cap_reply_cap rc \<Rightarrow> capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL rc))) (to_bool (capReplyMaster_CL rc)) (to_bool (capReplyCanGrant_CL rc)) | Cap_cnode_cap ccap \<Rightarrow> capability.CNodeCap (capCNodePtr_CL ccap) (unat (capCNodeRadix_CL ccap)) (capCNodeGuard_CL ccap) (unat (capCNodeGuardSize_CL ccap)) | Cap_thread_cap tc \<Rightarrow> capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL tc))) | Cap_small_frame_cap sfc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL sfc)) (cap_small_frame_cap_CL.capFBasePtr_CL sfc) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL sfc)) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc, cap_small_frame_cap_CL.capFMappedAddress_CL sfc))) | Cap_frame_cap fc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL fc)) (cap_frame_cap_CL.capFBasePtr_CL fc) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL fc)) (framesize_to_H (capFSize_CL fc)) (if cap_frame_cap_CL.capFMappedASIDHigh_CL fc = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL fc = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL fc << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL fc, cap_frame_cap_CL.capFMappedAddress_CL fc))) | Cap_asid_pool_cap apc \<Rightarrow> capability.ArchObjectCap (arch_capability.ASIDPoolCap (capASIDPool_CL apc) (capASIDBase_CL apc)) | Cap_page_table_cap ptc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageTableCap (capPTBasePtr_CL ptc) (if to_bool (capPTIsMapped_CL ptc) then Some (capPTMappedASID_CL ptc, capPTMappedAddress_CL ptc) else None)) | Cap_page_directory_cap pdf \<Rightarrow> capability.ArchObjectCap (arch_capability.PageDirectoryCap (capPDBasePtr_CL pdf) (if to_bool (capPDIsMapped_CL pdf) then Some (capPDMappedASID_CL pdf) else None)) | Cap_asid_control_cap \<Rightarrow> capability.ArchObjectCap arch_capability.ASIDControlCap | Cap_irq_control_cap \<Rightarrow> capability.IRQControlCap | Cap_irq_handler_cap ihc \<Rightarrow> capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL ihc)) | Cap_zombie_cap zc \<Rightarrow> if isZombieTCB_C (capZombieType_CL zc) then capability.Zombie (capZombieID_CL zc && ~~ mask 5) ZombieTCB (unat (capZombieID_CL zc && mask 5)) else let radix = unat (capZombieType_CL zc) in capability.Zombie (capZombieID_CL zc && ~~ mask (radix + 1)) (ZombieCNode radix) (unat (capZombieID_CL zc && mask (radix + 1))) | Cap_domain_cap \<Rightarrow> capability.DomainCap) = capability.UntypedCap isdev frame 12 4096; capability.UntypedCap isdev frame 12 idx = (case cap_CL ctel' of Cap_null_cap \<Rightarrow> capability.NullCap | Cap_untyped_cap uc \<Rightarrow> capability.UntypedCap (to_bool (capIsDevice_CL uc)) (capPtr_CL uc) (unat (capBlockSize_CL uc)) (unat (capFreeIndex_CL uc << 4)) | Cap_endpoint_cap ec \<Rightarrow> capability.EndpointCap (capEPPtr_CL ec) (capEPBadge_CL ec) (to_bool (capCanSend_CL ec)) (to_bool (capCanReceive_CL ec)) (to_bool (capCanGrant_CL ec)) (to_bool (capCanGrantReply_CL ec)) | Cap_notification_cap ntfn \<Rightarrow> capability.NotificationCap (capNtfnPtr_CL ntfn) (capNtfnBadge_CL ntfn) (to_bool (capNtfnCanSend_CL ntfn)) (to_bool (capNtfnCanReceive_CL ntfn)) | Cap_reply_cap rc \<Rightarrow> capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL rc))) (to_bool (capReplyMaster_CL rc)) (to_bool (capReplyCanGrant_CL rc)) | Cap_cnode_cap ccap \<Rightarrow> capability.CNodeCap (capCNodePtr_CL ccap) (unat (capCNodeRadix_CL ccap)) (capCNodeGuard_CL ccap) (unat (capCNodeGuardSize_CL ccap)) | Cap_thread_cap tc \<Rightarrow> capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL tc))) | Cap_small_frame_cap sfc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL sfc)) (cap_small_frame_cap_CL.capFBasePtr_CL sfc) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL sfc)) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc, cap_small_frame_cap_CL.capFMappedAddress_CL sfc))) | Cap_frame_cap fc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL fc)) (cap_frame_cap_CL.capFBasePtr_CL fc) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL fc)) (framesize_to_H (capFSize_CL fc)) (if cap_frame_cap_CL.capFMappedASIDHigh_CL fc = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL fc = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL fc << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL fc, cap_frame_cap_CL.capFMappedAddress_CL fc))) | Cap_asid_pool_cap apc \<Rightarrow> capability.ArchObjectCap (arch_capability.ASIDPoolCap (capASIDPool_CL apc) (capASIDBase_CL apc)) | Cap_page_table_cap ptc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageTableCap (capPTBasePtr_CL ptc) (if to_bool (capPTIsMapped_CL ptc) then Some (capPTMappedASID_CL ptc, capPTMappedAddress_CL ptc) else None)) | Cap_page_directory_cap pdf \<Rightarrow> capability.ArchObjectCap (arch_capability.PageDirectoryCap (capPDBasePtr_CL pdf) (if to_bool (capPDIsMapped_CL pdf) then Some (capPDMappedASID_CL pdf) else None)) | Cap_asid_control_cap \<Rightarrow> capability.ArchObjectCap arch_capability.ASIDControlCap | Cap_irq_control_cap \<Rightarrow> capability.IRQControlCap | Cap_irq_handler_cap ihc \<Rightarrow> capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL ihc)) | Cap_zombie_cap zc \<Rightarrow> if isZombieTCB_C (capZombieType_CL zc) then capability.Zombie (capZombieID_CL zc && ~~ mask 5) ZombieTCB (unat (capZombieID_CL zc && mask 5)) else let radix = unat (capZombieType_CL zc) in capability.Zombie (capZombieID_CL zc && ~~ mask (radix + 1)) (ZombieCNode radix) (unat (capZombieID_CL zc && mask (radix + 1))) | Cap_domain_cap \<Rightarrow> capability.DomainCap); is_aligned 0x1000 4; {frame..+4096} \<subseteq> untypedRange (case cap_CL ctel' of Cap_null_cap \<Rightarrow> capability.NullCap | Cap_untyped_cap uc \<Rightarrow> capability.UntypedCap (to_bool (capIsDevice_CL uc)) (capPtr_CL uc) (unat (capBlockSize_CL uc)) (unat (capFreeIndex_CL uc << 4)) | Cap_endpoint_cap ec \<Rightarrow> capability.EndpointCap (capEPPtr_CL ec) (capEPBadge_CL ec) (to_bool (capCanSend_CL ec)) (to_bool (capCanReceive_CL ec)) (to_bool (capCanGrant_CL ec)) (to_bool (capCanGrantReply_CL ec)) | Cap_notification_cap ntfn \<Rightarrow> capability.NotificationCap (capNtfnPtr_CL ntfn) (capNtfnBadge_CL ntfn) (to_bool (capNtfnCanSend_CL ntfn)) (to_bool (capNtfnCanReceive_CL ntfn)) | Cap_reply_cap rc \<Rightarrow> capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL rc))) (to_bool (capReplyMaster_CL rc)) (to_bool (capReplyCanGrant_CL rc)) | Cap_cnode_cap ccap \<Rightarrow> capability.CNodeCap (capCNodePtr_CL ccap) (unat (capCNodeRadix_CL ccap)) (capCNodeGuard_CL ccap) (unat (capCNodeGuardSize_CL ccap)) | Cap_thread_cap tc \<Rightarrow> capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL tc))) | Cap_small_frame_cap sfc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL sfc)) (cap_small_frame_cap_CL.capFBasePtr_CL sfc) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL sfc)) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc, cap_small_frame_cap_CL.capFMappedAddress_CL sfc))) | Cap_frame_cap fc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL fc)) (cap_frame_cap_CL.capFBasePtr_CL fc) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL fc)) (framesize_to_H (capFSize_CL fc)) (if cap_frame_cap_CL.capFMappedASIDHigh_CL fc = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL fc = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL fc << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL fc, cap_frame_cap_CL.capFMappedAddress_CL fc))) | Cap_asid_pool_cap apc \<Rightarrow> capability.ArchObjectCap (arch_capability.ASIDPoolCap (capASIDPool_CL apc) (capASIDBase_CL apc)) | Cap_page_table_cap ptc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageTableCap (capPTBasePtr_CL ptc) (if to_bool (capPTIsMapped_CL ptc) then Some (capPTMappedASID_CL ptc, capPTMappedAddress_CL ptc) else None)) | Cap_page_directory_cap pdf \<Rightarrow> capability.ArchObjectCap (arch_capability.PageDirectoryCap (capPDBasePtr_CL pdf) (if to_bool (capPDIsMapped_CL pdf) then Some (capPDMappedASID_CL pdf) else None)) | Cap_asid_control_cap \<Rightarrow> capability.ArchObjectCap arch_capability.ASIDControlCap | Cap_irq_control_cap \<Rightarrow> capability.IRQControlCap | Cap_irq_handler_cap ihc \<Rightarrow> capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL ihc)) | Cap_zombie_cap zc \<Rightarrow> if isZombieTCB_C (capZombieType_CL zc) then capability.Zombie (capZombieID_CL zc && ~~ mask 5) ZombieTCB (unat (capZombieID_CL zc && mask 5)) else let radix = unat (capZombieType_CL zc) in capability.Zombie (capZombieID_CL zc && ~~ mask (radix + 1)) (ZombieCNode radix) (unat (capZombieID_CL zc && mask (radix + 1))) | Cap_domain_cap \<Rightarrow> capability.DomainCap); {frame..0xFFF + frame} \<subseteq> untypedRange (case cap_CL ctel' of Cap_null_cap \<Rightarrow> capability.NullCap | Cap_untyped_cap uc \<Rightarrow> capability.UntypedCap (to_bool (capIsDevice_CL uc)) (capPtr_CL uc) (unat (capBlockSize_CL uc)) (unat (capFreeIndex_CL uc << 4)) | Cap_endpoint_cap ec \<Rightarrow> capability.EndpointCap (capEPPtr_CL ec) (capEPBadge_CL ec) (to_bool (capCanSend_CL ec)) (to_bool (capCanReceive_CL ec)) (to_bool (capCanGrant_CL ec)) (to_bool (capCanGrantReply_CL ec)) | Cap_notification_cap ntfn \<Rightarrow> capability.NotificationCap (capNtfnPtr_CL ntfn) (capNtfnBadge_CL ntfn) (to_bool (capNtfnCanSend_CL ntfn)) (to_bool (capNtfnCanReceive_CL ntfn)) | Cap_reply_cap rc \<Rightarrow> capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL rc))) (to_bool (capReplyMaster_CL rc)) (to_bool (capReplyCanGrant_CL rc)) | Cap_cnode_cap ccap \<Rightarrow> capability.CNodeCap (capCNodePtr_CL ccap) (unat (capCNodeRadix_CL ccap)) (capCNodeGuard_CL ccap) (unat (capCNodeGuardSize_CL ccap)) | Cap_thread_cap tc \<Rightarrow> capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL tc))) | Cap_small_frame_cap sfc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL sfc)) (cap_small_frame_cap_CL.capFBasePtr_CL sfc) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL sfc)) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc, cap_small_frame_cap_CL.capFMappedAddress_CL sfc))) | Cap_frame_cap fc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL fc)) (cap_frame_cap_CL.capFBasePtr_CL fc) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL fc)) (framesize_to_H (capFSize_CL fc)) (if cap_frame_cap_CL.capFMappedASIDHigh_CL fc = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL fc = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL fc << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL fc, cap_frame_cap_CL.capFMappedAddress_CL fc))) | Cap_asid_pool_cap apc \<Rightarrow> capability.ArchObjectCap (arch_capability.ASIDPoolCap (capASIDPool_CL apc) (capASIDBase_CL apc)) | Cap_page_table_cap ptc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageTableCap (capPTBasePtr_CL ptc) (if to_bool (capPTIsMapped_CL ptc) then Some (capPTMappedASID_CL ptc, capPTMappedAddress_CL ptc) else None)) | Cap_page_directory_cap pdf \<Rightarrow> capability.ArchObjectCap (arch_capability.PageDirectoryCap (capPDBasePtr_CL pdf) (if to_bool (capPDIsMapped_CL pdf) then Some (capPDMappedASID_CL pdf) else None)) | Cap_asid_control_cap \<Rightarrow> capability.ArchObjectCap arch_capability.ASIDControlCap | Cap_irq_control_cap \<Rightarrow> capability.IRQControlCap | Cap_irq_handler_cap ihc \<Rightarrow> capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL ihc)) | Cap_zombie_cap zc \<Rightarrow> if isZombieTCB_C (capZombieType_CL zc) then capability.Zombie (capZombieID_CL zc && ~~ mask 5) ZombieTCB (unat (capZombieID_CL zc && mask 5)) else let radix = unat (capZombieType_CL zc) in capability.Zombie (capZombieID_CL zc && ~~ mask (radix + 1)) (ZombieCNode radix) (unat (capZombieID_CL zc && mask (radix + 1))) | Cap_domain_cap \<Rightarrow> capability.DomainCap); capFreeIndex (case cap_CL ctel' of Cap_null_cap \<Rightarrow> capability.NullCap | Cap_untyped_cap uc \<Rightarrow> capability.UntypedCap (to_bool (capIsDevice_CL uc)) (capPtr_CL uc) (unat (capBlockSize_CL uc)) (unat (capFreeIndex_CL uc << 4)) | Cap_endpoint_cap ec \<Rightarrow> capability.EndpointCap (capEPPtr_CL ec) (capEPBadge_CL ec) (to_bool (capCanSend_CL ec)) (to_bool (capCanReceive_CL ec)) (to_bool (capCanGrant_CL ec)) (to_bool (capCanGrantReply_CL ec)) | Cap_notification_cap ntfn \<Rightarrow> capability.NotificationCap (capNtfnPtr_CL ntfn) (capNtfnBadge_CL ntfn) (to_bool (capNtfnCanSend_CL ntfn)) (to_bool (capNtfnCanReceive_CL ntfn)) | Cap_reply_cap rc \<Rightarrow> capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL rc))) (to_bool (capReplyMaster_CL rc)) (to_bool (capReplyCanGrant_CL rc)) | Cap_cnode_cap ccap \<Rightarrow> capability.CNodeCap (capCNodePtr_CL ccap) (unat (capCNodeRadix_CL ccap)) (capCNodeGuard_CL ccap) (unat (capCNodeGuardSize_CL ccap)) | Cap_thread_cap tc \<Rightarrow> capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL tc))) | Cap_small_frame_cap sfc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL sfc)) (cap_small_frame_cap_CL.capFBasePtr_CL sfc) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL sfc)) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc, cap_small_frame_cap_CL.capFMappedAddress_CL sfc))) | Cap_frame_cap fc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL fc)) (cap_frame_cap_CL.capFBasePtr_CL fc) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL fc)) (framesize_to_H (capFSize_CL fc)) (if cap_frame_cap_CL.capFMappedASIDHigh_CL fc = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL fc = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL fc << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL fc, cap_frame_cap_CL.capFMappedAddress_CL fc))) | Cap_asid_pool_cap apc \<Rightarrow> capability.ArchObjectCap (arch_capability.ASIDPoolCap (capASIDPool_CL apc) (capASIDBase_CL apc)) | Cap_page_table_cap ptc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageTableCap (capPTBasePtr_CL ptc) (if to_bool (capPTIsMapped_CL ptc) then Some (capPTMappedASID_CL ptc, capPTMappedAddress_CL ptc) else None)) | Cap_page_directory_cap pdf \<Rightarrow> capability.ArchObjectCap (arch_capability.PageDirectoryCap (capPDBasePtr_CL pdf) (if to_bool (capPDIsMapped_CL pdf) then Some (capPDMappedASID_CL pdf) else None)) | Cap_asid_control_cap \<Rightarrow> capability.ArchObjectCap arch_capability.ASIDControlCap | Cap_irq_control_cap \<Rightarrow> capability.IRQControlCap | Cap_irq_handler_cap ihc \<Rightarrow> capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL ihc)) | Cap_zombie_cap zc \<Rightarrow> if isZombieTCB_C (capZombieType_CL zc) then capability.Zombie (capZombieID_CL zc && ~~ mask 5) ZombieTCB (unat (capZombieID_CL zc && mask 5)) else let radix = unat (capZombieType_CL zc) in capability.Zombie (capZombieID_CL zc && ~~ mask (radix + 1)) (ZombieCNode radix) (unat (capZombieID_CL zc && mask (radix + 1))) | Cap_domain_cap \<Rightarrow> capability.DomainCap) \<le> 4096; 4096 \<le> 2 ^ capBlockSize (case cap_CL ctel' of Cap_null_cap \<Rightarrow> capability.NullCap | Cap_untyped_cap uc \<Rightarrow> capability.UntypedCap (to_bool (capIsDevice_CL uc)) (capPtr_CL uc) (unat (capBlockSize_CL uc)) (unat (capFreeIndex_CL uc << 4)) | Cap_endpoint_cap ec \<Rightarrow> capability.EndpointCap (capEPPtr_CL ec) (capEPBadge_CL ec) (to_bool (capCanSend_CL ec)) (to_bool (capCanReceive_CL ec)) (to_bool (capCanGrant_CL ec)) (to_bool (capCanGrantReply_CL ec)) | Cap_notification_cap ntfn \<Rightarrow> capability.NotificationCap (capNtfnPtr_CL ntfn) (capNtfnBadge_CL ntfn) (to_bool (capNtfnCanSend_CL ntfn)) (to_bool (capNtfnCanReceive_CL ntfn)) | Cap_reply_cap rc \<Rightarrow> capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL rc))) (to_bool (capReplyMaster_CL rc)) (to_bool (capReplyCanGrant_CL rc)) | Cap_cnode_cap ccap \<Rightarrow> capability.CNodeCap (capCNodePtr_CL ccap) (unat (capCNodeRadix_CL ccap)) (capCNodeGuard_CL ccap) (unat (capCNodeGuardSize_CL ccap)) | Cap_thread_cap tc \<Rightarrow> capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL tc))) | Cap_small_frame_cap sfc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL sfc)) (cap_small_frame_cap_CL.capFBasePtr_CL sfc) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL sfc)) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc, cap_small_frame_cap_CL.capFMappedAddress_CL sfc))) | Cap_frame_cap fc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL fc)) (cap_frame_cap_CL.capFBasePtr_CL fc) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL fc)) (framesize_to_H (capFSize_CL fc)) (if cap_frame_cap_CL.capFMappedASIDHigh_CL fc = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL fc = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL fc << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL fc, cap_frame_cap_CL.capFMappedAddress_CL fc))) | Cap_asid_pool_cap apc \<Rightarrow> capability.ArchObjectCap (arch_capability.ASIDPoolCap (capASIDPool_CL apc) (capASIDBase_CL apc)) | Cap_page_table_cap ptc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageTableCap (capPTBasePtr_CL ptc) (if to_bool (capPTIsMapped_CL ptc) then Some (capPTMappedASID_CL ptc, capPTMappedAddress_CL ptc) else None)) | Cap_page_directory_cap pdf \<Rightarrow> capability.ArchObjectCap (arch_capability.PageDirectoryCap (capPDBasePtr_CL pdf) (if to_bool (capPDIsMapped_CL pdf) then Some (capPDMappedASID_CL pdf) else None)) | Cap_asid_control_cap \<Rightarrow> capability.ArchObjectCap arch_capability.ASIDControlCap | Cap_irq_control_cap \<Rightarrow> capability.IRQControlCap | Cap_irq_handler_cap ihc \<Rightarrow> capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL ihc)) | Cap_zombie_cap zc \<Rightarrow> if isZombieTCB_C (capZombieType_CL zc) then capability.Zombie (capZombieID_CL zc && ~~ mask 5) ZombieTCB (unat (capZombieID_CL zc && mask 5)) else let radix = unat (capZombieType_CL zc) in capability.Zombie (capZombieID_CL zc && ~~ mask (radix + 1)) (ZombieCNode radix) (unat (capZombieID_CL zc && mask (radix + 1))) | Cap_domain_cap \<Rightarrow> capability.DomainCap); ctes_of sa parent = Some (cte_to_H ctel'); clift (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))) (cte_Ptr parent) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'; c_valid_cap (cte_C.cap_C cte'); region_actually_is_bytes' frame 4096 (typ_region_bytes frame 12 (hrs_htd (t_hrs_' (globals s')))); ret__unsigned_' t = capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')); capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4 < 0x20; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; t_hrs_' (globals ta) = hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))); cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C y')) - 4) && mask 26\<rparr>; Some (case cap_CL ctel' of Cap_null_cap \<Rightarrow> capability.NullCap | Cap_untyped_cap uc \<Rightarrow> capability.UntypedCap (to_bool (capIsDevice_CL uc)) (capPtr_CL uc) (unat (capBlockSize_CL uc)) (unat (capFreeIndex_CL uc << 4)) | Cap_endpoint_cap ec \<Rightarrow> capability.EndpointCap (capEPPtr_CL ec) (capEPBadge_CL ec) (to_bool (capCanSend_CL ec)) (to_bool (capCanReceive_CL ec)) (to_bool (capCanGrant_CL ec)) (to_bool (capCanGrantReply_CL ec)) | Cap_notification_cap ntfn \<Rightarrow> capability.NotificationCap (capNtfnPtr_CL ntfn) (capNtfnBadge_CL ntfn) (to_bool (capNtfnCanSend_CL ntfn)) (to_bool (capNtfnCanReceive_CL ntfn)) | Cap_reply_cap rc \<Rightarrow> capability.ReplyCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_reply_cap_CL.capTCBPtr_CL rc))) (to_bool (capReplyMaster_CL rc)) (to_bool (capReplyCanGrant_CL rc)) | Cap_cnode_cap ccap \<Rightarrow> capability.CNodeCap (capCNodePtr_CL ccap) (unat (capCNodeRadix_CL ccap)) (capCNodeGuard_CL ccap) (unat (capCNodeGuardSize_CL ccap)) | Cap_thread_cap tc \<Rightarrow> capability.ThreadCap (ctcb_ptr_to_tcb_ptr (tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL tc))) | Cap_small_frame_cap sfc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL sfc)) (cap_small_frame_cap_CL.capFBasePtr_CL sfc) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL sfc)) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL sfc << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL sfc, cap_small_frame_cap_CL.capFMappedAddress_CL sfc))) | Cap_frame_cap fc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL fc)) (cap_frame_cap_CL.capFBasePtr_CL fc) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL fc)) (framesize_to_H (capFSize_CL fc)) (if cap_frame_cap_CL.capFMappedASIDHigh_CL fc = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL fc = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL fc << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL fc, cap_frame_cap_CL.capFMappedAddress_CL fc))) | Cap_asid_pool_cap apc \<Rightarrow> capability.ArchObjectCap (arch_capability.ASIDPoolCap (capASIDPool_CL apc) (capASIDBase_CL apc)) | Cap_page_table_cap ptc \<Rightarrow> capability.ArchObjectCap (arch_capability.PageTableCap (capPTBasePtr_CL ptc) (if to_bool (capPTIsMapped_CL ptc) then Some (capPTMappedASID_CL ptc, capPTMappedAddress_CL ptc) else None)) | Cap_page_directory_cap pdf \<Rightarrow> capability.ArchObjectCap (arch_capability.PageDirectoryCap (capPDBasePtr_CL pdf) (if to_bool (capPDIsMapped_CL pdf) then Some (capPDMappedASID_CL pdf) else None)) | Cap_asid_control_cap \<Rightarrow> capability.ArchObjectCap arch_capability.ASIDControlCap | Cap_irq_control_cap \<Rightarrow> capability.IRQControlCap | Cap_irq_handler_cap ihc \<Rightarrow> capability.IRQHandlerCap (UCAST(32 \<rightarrow> 10) (capIRQ_CL ihc)) | Cap_zombie_cap zc \<Rightarrow> if isZombieTCB_C (capZombieType_CL zc) then capability.Zombie (capZombieID_CL zc && ~~ mask 5) ZombieTCB (unat (capZombieID_CL zc && mask 5)) else let radix = unat (capZombieType_CL zc) in capability.Zombie (capZombieID_CL zc && ~~ mask (radix + 1)) (ZombieCNode radix) (unat (capZombieID_CL zc && mask (radix + 1))) | Cap_domain_cap \<Rightarrow> capability.DomainCap) = map_option cap_to_H (cap_lift (cte_C.cap_C y')); c_valid_cap (cte_C.cap_C y'); t_hrs_' (globals tb) = hrs_mem_update (heap_update_list frame (replicate 4096 0)) (hrs_mem_update (heap_update (cte_Ptr parent) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s'))))); htd_safe domain (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s'))))); htd_safe domain (ptr_retyp (ap_Ptr frame) (hrs_htd (fst (t_hrs_' (globals s')), typ_region_bytes frame 12 (snd (t_hrs_' (globals s')))))); cap_lift v = Some (Cap_asid_pool_cap \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr>); cap_asid_pool_cap_lift v = \<lparr>capASIDBase_CL = base && mask 17, capASIDPool_CL = frame\<rparr>; base && mask local.asid_bits = base\<rbrakk> \<Longrightarrow> base = base && mask 17 proof (prove)
goal:
No subgoals!