theory Finalise_C

lemma Arch_finaliseCap_ccorres:
  notes Collect_const[simp del]
  shows
  "ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and>
                     ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv'))
      ret__struct_finaliseCap_ret_C_'
   (invs' and valid_cap' (ArchObjectCap cp)
       and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s))
   (UNIV \<inter> {s. ccap_relation (ArchObjectCap cp) (cap_' s)}
                        \<inter> {s. final_' s = from_bool is_final}) []
   (Arch.finaliseCap cp is_final) (Call Arch_finaliseCap_'proc)" supply if_cong[cong] apply (cinit lift: cap_' final_' cong: call_ignore_cong) apply csymbr apply (simp add: ARM_H.finaliseCap_def cap_get_tag_isCap_ArchObject) apply (simp add: split_def) apply (rule ccorres_cases[where P=is_final]; clarsimp) prefer 2 apply (subgoal_tac "isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp") apply (rule ccorres_cases[where P="isPageCap cp"]; clarsimp) prefer 2 apply (rule ccorres_inst[where P=\<top> and P'=UNIV]) apply (cases cp; ccorres_rewrite C_simp_simps: isCap_simps) apply return_NullCap_pair_ccorres apply return_NullCap_pair_ccorres apply return_NullCap_pair_ccorres apply (subst ccorres_cond_seq2_seq[symmetric]) apply (rule ccorres_guard_imp) apply (rule ccorres_rhs_assoc) apply csymbr apply ccorres_rewrite apply (return_NullCap_pair_ccorres, simp+) apply (subst ccorres_cond_seq2_seq[symmetric]) apply (rule ccorres_guard_imp) apply (rule ccorres_rhs_assoc) apply csymbr apply ccorres_rewrite apply (return_NullCap_pair_ccorres, simp+) apply ccorres_rewrite apply (rule ccorres_Cond_rhs_Seq) apply (subgoal_tac "isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp") apply clarsimp apply (rule ccorres_rhs_assoc)+ apply csymbr apply clarsimp apply (rule ccorres_Cond_rhs_Seq) apply (subgoal_tac "capVPMappedAddress cp \<noteq> None") prefer 2 apply (clarsimp simp: isCap_simps) apply (frule cap_get_tag_isCap_unfolded_H_cap, simp) apply (frule small_frame_cap_is_mapped_alt) apply (clarsimp simp: cap_small_frame_cap_lift cap_to_H_def
                               case_option_over_if
                         elim!: ccap_relationE) apply (simp add: split_def) apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply csymbr apply (ctac (no_vcg) add:  unmapPage_ccorres) apply return_NullCap_pair_ccorres apply (rule wp_post_taut) apply (subgoal_tac "capVPMappedAddress cp = None") prefer 2 apply (clarsimp simp: isCap_simps) apply (frule cap_get_tag_isCap_unfolded_H_cap, simp) apply (frule small_frame_cap_is_mapped_alt) apply (clarsimp simp: cap_small_frame_cap_lift cap_to_H_def
                              case_option_over_if
                        elim!: ccap_relationE) apply (simp add: split_def) apply return_NullCap_pair_ccorres apply (clarsimp simp: isCap_simps) apply (rule ccorres_Cond_rhs_Seq) apply (subgoal_tac "isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp") apply clarsimp apply (rule ccorres_rhs_assoc)+ apply csymbr apply clarsimp apply (rule ccorres_Cond_rhs_Seq) apply (subgoal_tac "capVPMappedAddress cp \<noteq> None") prefer 2 apply (clarsimp simp: isCap_simps) apply (frule (1) cap_get_tag_isCap_unfolded_H_cap) apply (frule frame_cap_is_mapped_alt) apply (clarsimp simp: cap_frame_cap_lift cap_to_H_def
                               case_option_over_if
                         elim!: ccap_relationE) apply simp apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply csymbr apply csymbr apply (ctac (no_vcg) add:  unmapPage_ccorres) apply return_NullCap_pair_ccorres apply (rule wp_post_taut) apply (subgoal_tac "capVPMappedAddress cp = None") prefer 2 apply (clarsimp simp: isCap_simps) apply (frule (1) cap_get_tag_isCap_unfolded_H_cap) apply (frule frame_cap_is_mapped_alt) apply (clarsimp simp: cap_frame_cap_lift cap_to_H_def
                              case_option_over_if
                    elim!: ccap_relationE) apply clarsimp apply return_NullCap_pair_ccorres apply (clarsimp simp: isCap_simps) apply (clarsimp simp: isCap_simps) apply (clarsimp simp: isCap_simps) apply ccorres_rewrite apply (rule ccorres_Cond_rhs_Seq; clarsimp) apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply (ctac (no_vcg) add: deleteASIDPool_ccorres) apply return_NullCap_pair_ccorres apply (rule wp_post_taut) apply (rule ccorres_Cond_rhs_Seq; clarsimp) apply (rule ccorres_rhs_assoc)+ apply csymbr apply clarsimp apply ccorres_rewrite apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply simp apply (subgoal_tac "isPageDirectoryCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp") apply clarsimp apply (rule ccorres_Cond_rhs_Seq) apply (subgoal_tac "capPDMappedASID cp \<noteq> None") prefer 2 apply (clarsimp simp add: isCap_simps) apply (frule cap_get_tag_isCap_unfolded_H_cap) apply (frule cap_lift_page_directory_cap) apply (clarsimp simp: ccap_relation_def cap_to_H_def capAligned_def
                             to_bool_def cap_page_directory_cap_lift_def
                             asid_bits_def
                       split: if_split_asm) apply simp apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply (ctac (no_vcg) add: deleteASID_ccorres) apply return_NullCap_pair_ccorres apply (rule wp_post_taut) apply (subgoal_tac "capPDMappedASID cp = None") prefer 2 apply (clarsimp simp add: isCap_simps) apply (frule cap_get_tag_isCap_unfolded_H_cap) apply (frule cap_lift_page_directory_cap) apply (clarsimp simp: ccap_relation_def cap_to_H_def capAligned_def
                            cap_page_directory_cap_lift_def
                            asid_bits_def
                      split: if_split_asm) apply simp apply return_NullCap_pair_ccorres apply (clarsimp simp add: isCap_simps) apply (rule ccorres_Cond_rhs_Seq) apply (subgoal_tac "isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp") apply clarsimp apply (rule ccorres_rhs_assoc)+ apply csymbr apply ccorres_rewrite apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply clarsimp apply (rule ccorres_Cond_rhs_Seq) apply (subgoal_tac "capPTMappedAddress cp \<noteq> None") prefer 2 apply (clarsimp simp add: isCap_simps) apply (frule cap_get_tag_isCap_unfolded_H_cap) apply (frule cap_lift_page_table_cap) apply (clarsimp simp: ccap_relation_def cap_to_H_def capAligned_def
                             to_bool_def cap_page_table_cap_lift_def
                             asid_bits_def
                       split: if_split_asm) apply simp apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply csymbr apply (simp add: split_def) apply (ctac (no_vcg) add: unmapPageTable_ccorres) apply return_NullCap_pair_ccorres apply (rule wp_post_taut) apply clarsimp apply (subgoal_tac "capPTMappedAddress cp = None") prefer 2 apply (clarsimp simp add: isCap_simps) apply (frule cap_get_tag_isCap_unfolded_H_cap) apply (frule cap_lift_page_table_cap) apply (clarsimp simp: ccap_relation_def cap_to_H_def capAligned_def
                            cap_page_table_cap_lift_def asid_bits_def
                     split: if_split_asm) apply simp apply return_NullCap_pair_ccorres apply (clarsimp simp: isCap_simps) apply (rule ccorres_Cond_rhs_Seq) apply (subgoal_tac "isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp") apply clarsimp apply (rule ccorres_rhs_assoc)+ apply csymbr apply clarsimp apply (rule ccorres_Cond_rhs_Seq) apply (subgoal_tac "capVPMappedAddress cp \<noteq> None") prefer 2 apply (clarsimp simp: isCap_simps) apply (frule cap_get_tag_isCap_unfolded_H_cap, simp) apply (frule small_frame_cap_is_mapped_alt) apply (clarsimp simp: cap_small_frame_cap_lift cap_to_H_def
                             case_option_over_if
                       elim!: ccap_relationE) apply (simp add: split_def) apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply csymbr apply (ctac (no_vcg) add:  unmapPage_ccorres) apply return_NullCap_pair_ccorres apply (rule wp_post_taut) apply (subgoal_tac "capVPMappedAddress cp = None") prefer 2 apply (clarsimp simp: isCap_simps) apply (frule cap_get_tag_isCap_unfolded_H_cap, simp) apply (frule small_frame_cap_is_mapped_alt) apply (clarsimp simp: cap_small_frame_cap_lift cap_to_H_def
                            case_option_over_if
                     elim!: ccap_relationE) apply (simp add: split_def) apply return_NullCap_pair_ccorres apply (clarsimp simp: isCap_simps) apply (rule ccorres_Cond_rhs_Seq) apply (subgoal_tac "isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp") apply clarsimp apply (rule ccorres_rhs_assoc)+ apply csymbr apply clarsimp apply (rule ccorres_Cond_rhs_Seq) apply (subgoal_tac "capVPMappedAddress cp \<noteq> None") prefer 2 apply (clarsimp simp: isCap_simps) apply (frule (1) cap_get_tag_isCap_unfolded_H_cap) apply (frule frame_cap_is_mapped_alt) apply (clarsimp simp: cap_frame_cap_lift cap_to_H_def
                             case_option_over_if
                       elim!: ccap_relationE) apply simp apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply csymbr apply csymbr apply (ctac (no_vcg) add:  unmapPage_ccorres) apply return_NullCap_pair_ccorres apply (rule wp_post_taut) apply (subgoal_tac "capVPMappedAddress cp = None") prefer 2 apply (clarsimp simp: isCap_simps) apply (frule (1) cap_get_tag_isCap_unfolded_H_cap) apply (frule frame_cap_is_mapped_alt) apply (clarsimp simp: cap_frame_cap_lift cap_to_H_def
                            case_option_over_if
                      elim!: ccap_relationE) apply clarsimp apply return_NullCap_pair_ccorres apply (clarsimp simp: isCap_simps) apply clarsimp apply return_NullCap_pair_ccorres apply (cases cp ; clarsimp simp: isCap_simps) apply (cases is_final; clarsimp simp: isCap_simps) apply (frule cap_get_tag_isCap_unfolded_H_cap) apply (frule cap_lift_asid_pool_cap) apply (clarsimp simp: valid_cap'_def) apply (clarsimp simp: ccap_relation_def cap_to_H_def
                            cap_asid_pool_cap_lift_def asid_bits_def) apply (intro conjI; clarsimp) apply (subgoal_tac "capVPMappedAddress cp \<noteq> None") apply (clarsimp simp: valid_cap'_def asid_bits_def mask_def word_less_sub_1) apply (frule cap_get_tag_isCap_unfolded_H_cap, simp) apply (frule small_frame_cap_is_mapped_alt) apply (clarsimp simp: cap_small_frame_cap_lift cap_to_H_def
                              case_option_over_if
                        elim!: ccap_relationE) apply (subgoal_tac "capVPMappedAddress cp \<noteq> None") apply (clarsimp simp: valid_cap'_def asid_bits_def mask_def word_less_sub_1) apply (frule (1) cap_get_tag_isCap_unfolded_H_cap, simp) apply (frule frame_cap_is_mapped_alt) apply (clarsimp simp: cap_frame_cap_lift cap_to_H_def
                             case_option_over_if
                       elim!: ccap_relationE) apply (rule conjI, clarsimp) apply (frule cap_get_tag_isCap_unfolded_H_cap, simp) apply (frule small_frame_cap_is_mapped_alt) apply (subgoal_tac "capVPMappedAddress cp \<noteq> None") apply (clarsimp simp: cap_small_frame_cap_lift cap_to_H_def
                              case_option_over_if gen_framesize_to_H_def
                              Kernel_C.ARMSmallPage_def ARM.pptrBase_def
                              if_split
                       elim!: ccap_relationE) apply (clarsimp simp: cap_small_frame_cap_lift cap_to_H_def
                             case_option_over_if
                        elim!: ccap_relationE) apply (frule cap_get_tag_isCap_unfolded_H_cap, simp, simp) apply (rule conjI, clarsimp) apply (subgoal_tac "capVPMappedAddress cp \<noteq> None") apply clarsimp apply (frule (1) cap_get_tag_isCap_unfolded_H_cap) apply (frule frame_cap_is_mapped_alt) apply (frule capFSize_eq, simp) apply simp apply (rule conjI) apply (frule (1) cap_get_tag_isCap_unfolded_H_cap) apply (frule capFSize_range) apply (rule order_le_less_trans, assumption, simp) apply (clarsimp simp: word_less_sub_1) apply (clarsimp simp: cap_frame_cap_lift cap_to_H_def
                             case_option_over_if gen_framesize_to_H_def
                             if_split
                       elim!: ccap_relationE) apply (frule (1) cap_get_tag_isCap_unfolded_H_cap) apply (frule frame_cap_is_mapped_alt) apply (clarsimp simp: cap_frame_cap_lift cap_to_H_def
                     elim!: ccap_relationE) apply (frule (1) cap_get_tag_isCap_unfolded_H_cap, simp) apply (cases is_final; clarsimp) apply (intro conjI; clarsimp?) apply (frule cap_get_tag_isCap_unfolded_H_cap) apply (frule cap_lift_page_table_cap) apply (subgoal_tac "x42 \<noteq> None") apply (clarsimp simp: valid_cap'_def asid_bits_def mask_def word_less_sub_1) apply (clarsimp simp: ccap_relation_def cap_to_H_def capAligned_def
                             to_bool_def cap_page_table_cap_lift_def
                             asid_bits_def
                      split: if_split_asm) apply (frule cap_get_tag_isCap_unfolded_H_cap) apply (frule cap_lift_page_table_cap) apply (subgoal_tac "x42 \<noteq> None") apply ((clarsimp simp: ccap_relation_def cap_to_H_def capAligned_def
                             to_bool_def cap_page_table_cap_lift_def
                             asid_bits_def
                      split: if_split_asm)+)[2] apply (frule cap_get_tag_isCap_unfolded_H_cap, simp) apply (cases is_final; clarsimp) apply (intro conjI; clarsimp?) apply (subgoal_tac "x52 \<noteq> None") apply (clarsimp simp: valid_cap'_def) apply (clarsimp simp: asid_bits_def mask_def word_less_sub_1) apply (frule cap_get_tag_isCap_unfolded_H_cap) apply (frule cap_lift_page_directory_cap) apply (clarsimp simp: ccap_relation_def cap_to_H_def capAligned_def
                           to_bool_def cap_page_directory_cap_lift_def
                           asid_bits_def
                     split: if_split_asm) apply (subgoal_tac "x52 \<noteq> None") apply (frule cap_get_tag_isCap_unfolded_H_cap) apply (frule cap_lift_page_directory_cap) apply (clarsimp simp: ccap_relation_def cap_to_H_def capAligned_def
                           cap_page_directory_cap_lift_def
                           asid_bits_def
                     split: if_split_asm) apply (frule cap_get_tag_isCap_unfolded_H_cap) apply (frule cap_lift_page_directory_cap) apply (clarsimp simp: ccap_relation_def cap_to_H_def capAligned_def
                          to_bool_def cap_page_directory_cap_lift_def
                          asid_bits_def
                    split: if_split_asm) apply (frule cap_get_tag_isCap_unfolded_H_cap, simp) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) (UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap cp) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool is_final\<rbrace>) [] (Arch.finaliseCap cp is_final) (Call Arch_finaliseCap_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) (UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap cp) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>final = from_bool is_final\<rbrace>) [] (Arch.finaliseCap cp is_final) (Call Arch_finaliseCap_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>final cap. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q2772 final cap) (?Q'2772 final cap) [SKIP] (Arch.finaliseCap cp is_final) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap THEN
  IF final \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,ap_Ptr (UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2))
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap THEN
  \<acute>ret__int :== (if final \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,pde_Ptr (UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2))
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap THEN
  \<acute>ret__int :== (if final \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2,pte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_3))
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,PTR(unit) (UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2))
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>ret__unsigned_long,UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2,PTR(unit) (UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_3))
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))
 2. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2772 final cap s \<and> s' \<in> ?Q'2772 final cap proof (prove)
goal (2 subgoals):
 1. \<And>final cap ret__unsigned. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; ret__unsigned = cap_get_tag cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q2772 final cap) (?G'2781 final cap ret__unsigned) [SKIP] (Arch.finaliseCap cp is_final) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap THEN
  IF final \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,ap_Ptr (UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2))
FI
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap THEN
  \<acute>ret__int :== (if final \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,pde_Ptr (UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2))
FI
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap THEN
  \<acute>ret__int :== (if final \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2,pte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_3))
FI
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,PTR(unit) (UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2))
FI
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>ret__unsigned_long,UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2,PTR(unit) (UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_3))
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2772 final cap s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'2781 final cap v} proof (prove)
goal (2 subgoals):
 1. \<And>final cap ret__unsigned. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; ret__unsigned = cap_get_tag cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q2772 (from_bool is_final) cap) (?G'2781 (from_bool is_final) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp \<and> is_final then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> is_final \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> is_final \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then case the (capPTMappedAddress cp) of (a, v) \<Rightarrow> do y <- unmapPageTable a v (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then case the (capVPMappedAddress cp) of (a, v) \<Rightarrow> do y <- unmapPage (capVPSize cp) a v (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF is_final THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== (if is_final then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== (if is_final then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2772 final cap s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'2781 final cap v} proof (prove)
goal (2 subgoals):
 1. \<And>final cap ret__unsigned. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; ret__unsigned = cap_get_tag cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q2772 (from_bool is_final) cap) (?G'2781 (from_bool is_final) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp \<and> is_final then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> is_final \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> is_final \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF is_final THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== (if is_final then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== (if is_final then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2772 final cap s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'2781 final cap v} proof (prove)
goal (3 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?H3358 (SCAST(32 signed \<rightarrow> 32) false) cap) (?H'3360 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF False THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> ?H3358 final cap s)) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> ?H'3360 final cap v}} proof (prove)
goal (3 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?H3358 (SCAST(32 signed \<rightarrow> 32) false) cap) (?H'3360 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF False THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> ?H3358 final cap s)) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> ?H'3360 final cap v}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?H3358 (SCAST(32 signed \<rightarrow> 32) false) cap) (?H'3360 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF False THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> ?H3358 final cap s)) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> ?H'3360 final cap v}} proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3385 (SCAST(32 signed \<rightarrow> 32) false) cap) (?G'3387 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF False THEN
  IF False THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?H3384 (SCAST(32 signed \<rightarrow> 32) false) cap) (?H'3386 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF False THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF False THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> ?G3385 final cap s) \<and> (\<not> isPageCap cp \<longrightarrow> ?H3384 final cap s))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> ?G'3387 final cap v} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> ?H'3386 final cap v}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?H3384 (SCAST(32 signed \<rightarrow> 32) false) cap) (?H'3386 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF False THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF False THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3385 (SCAST(32 signed \<rightarrow> 32) false) cap) (?G'3387 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF False THEN
  IF False THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> ?G3385 final cap s) \<and> (\<not> isPageCap cp \<longrightarrow> ?H3384 final cap s))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> ?G'3387 final cap v} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> ?H'3386 final cap v}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF False THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF False THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3385 (SCAST(32 signed \<rightarrow> 32) false) cap) (?G'3387 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF False THEN
  IF False THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> ?G3385 final cap s) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> ?G'3387 final cap v} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (9 subgoals):
 1. \<And>cap x11 x12. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp; cp = arch_capability.ASIDPoolCap x11 x12\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp; cp = arch_capability.ASIDControlCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))
 3. \<And>cap x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp; cp = arch_capability.PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))
 4. \<And>cap x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp; cp = arch_capability.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp; cp = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3385 (SCAST(32 signed \<rightarrow> 32) false) cap) (?G'3387 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF False THEN
  IF False THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 8. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 9. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> ?G3385 final cap s) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> ?G'3387 final cap v} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (8 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp; cp = arch_capability.ASIDControlCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))
 2. \<And>cap x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp; cp = arch_capability.PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))
 3. \<And>cap x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp; cp = arch_capability.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp; cp = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3385 (SCAST(32 signed \<rightarrow> 32) false) cap) (?G'3387 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF False THEN
  IF False THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 7. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 8. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> ?G3385 final cap s) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> ?G'3387 final cap v} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>cap x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp; cp = arch_capability.PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))
 2. \<And>cap x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp; cp = arch_capability.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp; cp = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3385 (SCAST(32 signed \<rightarrow> 32) false) cap) (?G'3387 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF False THEN
  IF False THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> ?G3385 final cap s) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> ?G'3387 final cap v} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp; cp = arch_capability.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp; cp = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3385 (SCAST(32 signed \<rightarrow> 32) false) cap) (?G'3387 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF False THEN
  IF False THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> ?G3385 final cap s) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> ?G'3387 final cap v} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp; cp = arch_capability.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp; cp = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3385 (SCAST(32 signed \<rightarrow> 32) false) cap) (?G'3387 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF False THEN
  IF False THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> ?G3385 final cap s) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> ?G'3387 final cap v} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (8 subgoals):
 1. \<And>cap x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp; cp = arch_capability.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q4562 cap x41 x42) (?Q'4562 cap x41 x42) [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap x41 x42 s. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp; cp = arch_capability.PageTableCap x41 x42; True\<rbrakk> \<Longrightarrow> ?Q4562 cap x41 x42 s
 3. \<And>cap x41 x42 s. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp; cp = arch_capability.PageTableCap x41 x42; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Q'4562 cap x41 x42
 4. \<And>cap x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp; cp = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3385 (SCAST(32 signed \<rightarrow> 32) false) cap) (?G'3387 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF False THEN
  IF False THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 7. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 8. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> ?G3385 final cap s) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> ?G'3387 final cap v} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (8 subgoals):
 1. \<And>cap x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp; cp = arch_capability.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q4562 cap x41 x42) (?Q'4562 cap x41 x42) [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__int :== 0;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))
 2. \<And>cap x41 x42 s. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp; cp = arch_capability.PageTableCap x41 x42; True\<rbrakk> \<Longrightarrow> ?Q4562 cap x41 x42 s
 3. \<And>cap x41 x42 s. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp; cp = arch_capability.PageTableCap x41 x42; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Q'4562 cap x41 x42
 4. \<And>cap x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp; cp = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3385 (SCAST(32 signed \<rightarrow> 32) false) cap) (?G'3387 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF False THEN
  IF False THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 7. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 8. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> ?G3385 final cap s) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> ?G'3387 final cap v} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (8 subgoals):
 1. \<And>cap x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp; cp = arch_capability.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q4562 cap x41 x42) (?G'4570 cap x41 x42) [SKIP] (return (capability.NullCap, capability.NullCap)) (IF 0 \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  SKIP;;
IF 0 \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap x41 x42 s. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp; cp = arch_capability.PageTableCap x41 x42; True\<rbrakk> \<Longrightarrow> ?Q4562 cap x41 x42 s
 3. \<And>cap x41 x42 s. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp; cp = arch_capability.PageTableCap x41 x42; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> ?G'4570 cap x41 x42}
 4. \<And>cap x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp; cp = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3385 (SCAST(32 signed \<rightarrow> 32) false) cap) (?G'3387 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF False THEN
  IF False THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 7. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 8. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> ?G3385 final cap s) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> ?G'3387 final cap v} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (8 subgoals):
 1. \<And>cap x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp; cp = arch_capability.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q4562 cap x41 x42) (?G'4570 cap x41 x42) [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))
 2. \<And>cap x41 x42 s. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp; cp = arch_capability.PageTableCap x41 x42; True\<rbrakk> \<Longrightarrow> ?Q4562 cap x41 x42 s
 3. \<And>cap x41 x42 s. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp; cp = arch_capability.PageTableCap x41 x42; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> ?G'4570 cap x41 x42}
 4. \<And>cap x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; \<not> isPageCap cp; cp = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3385 (SCAST(32 signed \<rightarrow> 32) false) cap) (?G'3387 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF False THEN
  IF False THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 7. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 8. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> ?G3385 final cap s) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> ?G'3387 final cap v} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; \<not> is_final; \<not> isPageCap (arch_capability.PageDirectoryCap x51 x52); cp = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3385 (SCAST(32 signed \<rightarrow> 32) false) cap) (?G'3387 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF False THEN
  IF False THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> ?G3385 final cap s) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> ?G'3387 final cap v} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; \<not> is_final; \<not> isPageCap (arch_capability.PageDirectoryCap x51 x52); cp = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3385 (SCAST(32 signed \<rightarrow> 32) false) cap) (?G'3387 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF False THEN
  IF False THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> ?G3385 final cap s) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> ?G'3387 final cap v} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>cap x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; \<not> is_final; \<not> isPageCap (arch_capability.PageDirectoryCap x51 x52); cp = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q5035 cap x51 x52) (?Q'5035 cap x51 x52) [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap x51 x52 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; \<not> is_final; \<not> isPageCap (arch_capability.PageDirectoryCap x51 x52); cp = arch_capability.PageDirectoryCap x51 x52; True\<rbrakk> \<Longrightarrow> ?Q5035 cap x51 x52 s
 3. \<And>cap x51 x52 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; \<not> is_final; \<not> isPageCap (arch_capability.PageDirectoryCap x51 x52); cp = arch_capability.PageDirectoryCap x51 x52; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Q'5035 cap x51 x52
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3385 (SCAST(32 signed \<rightarrow> 32) false) cap) (?G'3387 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF False THEN
  IF False THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> ?G3385 final cap s) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> ?G'3387 final cap v} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>cap x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; \<not> is_final; \<not> isPageCap (arch_capability.PageDirectoryCap x51 x52); cp = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q5035 cap x51 x52) (?Q'5035 cap x51 x52) [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__int :== 0;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))
 2. \<And>cap x51 x52 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; \<not> is_final; \<not> isPageCap (arch_capability.PageDirectoryCap x51 x52); cp = arch_capability.PageDirectoryCap x51 x52; True\<rbrakk> \<Longrightarrow> ?Q5035 cap x51 x52 s
 3. \<And>cap x51 x52 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; \<not> is_final; \<not> isPageCap (arch_capability.PageDirectoryCap x51 x52); cp = arch_capability.PageDirectoryCap x51 x52; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Q'5035 cap x51 x52
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3385 (SCAST(32 signed \<rightarrow> 32) false) cap) (?G'3387 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF False THEN
  IF False THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> ?G3385 final cap s) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> ?G'3387 final cap v} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>cap x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; \<not> is_final; \<not> isPageCap (arch_capability.PageDirectoryCap x51 x52); cp = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q5035 cap x51 x52) (?G'5043 cap x51 x52) [SKIP] (return (capability.NullCap, capability.NullCap)) (IF 0 \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  SKIP;;
IF 0 \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap x51 x52 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; \<not> is_final; \<not> isPageCap (arch_capability.PageDirectoryCap x51 x52); cp = arch_capability.PageDirectoryCap x51 x52; True\<rbrakk> \<Longrightarrow> ?Q5035 cap x51 x52 s
 3. \<And>cap x51 x52 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; \<not> is_final; \<not> isPageCap (arch_capability.PageDirectoryCap x51 x52); cp = arch_capability.PageDirectoryCap x51 x52; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> ?G'5043 cap x51 x52}
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3385 (SCAST(32 signed \<rightarrow> 32) false) cap) (?G'3387 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF False THEN
  IF False THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> ?G3385 final cap s) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> ?G'3387 final cap v} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>cap x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; \<not> is_final; \<not> isPageCap (arch_capability.PageDirectoryCap x51 x52); cp = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?Q5035 cap x51 x52) (?G'5043 cap x51 x52) [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))
 2. \<And>cap x51 x52 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; \<not> is_final; \<not> isPageCap (arch_capability.PageDirectoryCap x51 x52); cp = arch_capability.PageDirectoryCap x51 x52; True\<rbrakk> \<Longrightarrow> ?Q5035 cap x51 x52 s
 3. \<And>cap x51 x52 s. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; \<not> is_final; \<not> isPageCap (arch_capability.PageDirectoryCap x51 x52); cp = arch_capability.PageDirectoryCap x51 x52; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 0\<rparr> \<in> ?G'5043 cap x51 x52}
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3385 (SCAST(32 signed \<rightarrow> 32) false) cap) (?G'3387 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF False THEN
  IF False THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> ?G3385 final cap s) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> ?G'3387 final cap v} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3385 (SCAST(32 signed \<rightarrow> 32) false) cap) (?G'3387 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF False THEN
  IF False THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF False THEN
  \<acute>ret__int :== 0;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> ?G3385 final cap s) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> ?G'3387 final cap v} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?G3385 (SCAST(32 signed \<rightarrow> 32) false) cap) (?G'3387 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> ?G3385 final cap s) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> ?G'3387 final cap v} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q5854 (SCAST(32 signed \<rightarrow> 32) false) cap) (?S5856 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R5853 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T5855 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ?Q5854 final cap s) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R5853 final cap s)) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?S5856 final cap v) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T5855 final cap v)}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q5854 (SCAST(32 signed \<rightarrow> 32) false) cap) (?S5856 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R5853 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T5855 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ?Q5854 final cap s) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R5853 final cap s)) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?S5856 final cap v) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T5855 final cap v)}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q5854 (SCAST(32 signed \<rightarrow> 32) false) cap) (?S5856 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R5853 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T5855 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ?Q5854 final cap s) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R5853 final cap s)) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?S5856 final cap v) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T5855 final cap v)}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q5854 (SCAST(32 signed \<rightarrow> 32) false) cap) (?S5856 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R5853 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T5855 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ?Q5854 final cap s) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R5853 final cap s)) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?S5856 final cap v) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T5855 final cap v)}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap ret__unsigned_long. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; ret__unsigned_long = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q5854 (SCAST(32 signed \<rightarrow> 32) false) cap) (?G'5891 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ret__unsigned_long) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R5853 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T5855 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ?Q5854 final cap s) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R5853 final cap s)) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> ?G'5891 final cap v va}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T5855 final cap v)}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q5854 (SCAST(32 signed \<rightarrow> 32) false) cap) (?G'5891 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R5853 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T5855 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ?Q5854 final cap s) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R5853 final cap s)) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> ?G'5891 final cap v va}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T5855 final cap v)}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q6024 (SCAST(32 signed \<rightarrow> 32) false) cap) (?S6026 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6023 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6025 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R5853 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T5855 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q6024 final cap s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R6023 final cap s)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R5853 final cap s)) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S6026 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T6025 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T5855 final cap v)}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (8 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q6024 (SCAST(32 signed \<rightarrow> 32) false) cap) (?S6026 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capVPMappedAddress cp \<noteq> None
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6023 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6025 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R5853 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T5855 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 7. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 8. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q6024 final cap s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R6023 final cap s)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R5853 final cap s)) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S6026 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T6025 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T5855 final cap v)}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (8 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capVPMappedAddress cp \<noteq> None
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q6024 (SCAST(32 signed \<rightarrow> 32) false) cap) (?S6026 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6023 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6025 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R5853 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T5855 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 7. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 8. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q6024 final cap s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R6023 final cap s)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R5853 final cap s)) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S6026 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T6025 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T5855 final cap v)}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (8 subgoals):
 1. \<And>cap d v0 v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 Wellformed_C.ARMSmallPage v3)) cap; \<not> is_final; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; cp = arch_capability.PageCap d v0 v1 Wellformed_C.ARMSmallPage v3\<rbrakk> \<Longrightarrow> \<exists>a b. v3 = Some (a, b)
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q6024 (SCAST(32 signed \<rightarrow> 32) false) cap) (?S6026 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6023 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6025 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R5853 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T5855 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 7. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 8. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q6024 final cap s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R6023 final cap s)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R5853 final cap s)) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S6026 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T6025 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T5855 final cap v)}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (8 subgoals):
 1. \<And>cap d v0 v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 Wellformed_C.ARMSmallPage v3)) cap; \<not> is_final; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; cp = arch_capability.PageCap d v0 v1 Wellformed_C.ARMSmallPage v3; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> \<exists>a b. v3 = Some (a, b)
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q6024 (SCAST(32 signed \<rightarrow> 32) false) cap) (?S6026 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6023 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6025 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R5853 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T5855 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 7. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 8. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q6024 final cap s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R6023 final cap s)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R5853 final cap s)) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S6026 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T6025 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T5855 final cap v)}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (8 subgoals):
 1. \<And>cap d v0 v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 Wellformed_C.ARMSmallPage v3)) cap; \<not> is_final; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; cp = arch_capability.PageCap d v0 v1 Wellformed_C.ARMSmallPage v3; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = 0) = ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = 0)\<rbrakk> \<Longrightarrow> \<exists>a b. v3 = Some (a, b)
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q6024 (SCAST(32 signed \<rightarrow> 32) false) cap) (?S6026 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6023 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6025 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R5853 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T5855 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 7. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 8. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q6024 final cap s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R6023 final cap s)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R5853 final cap s)) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S6026 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T6025 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T5855 final cap v)}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q6024 (SCAST(32 signed \<rightarrow> 32) false) cap) (?S6026 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6023 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6025 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R5853 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T5855 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q6024 final cap s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R6023 final cap s)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R5853 final cap s)) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S6026 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T6025 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T5855 final cap v)}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q6024 (SCAST(32 signed \<rightarrow> 32) false) cap) (?S6026 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od) (\<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6023 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6025 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R5853 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T5855 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q6024 final cap s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R6023 final cap s)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R5853 final cap s)) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S6026 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T6025 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T5855 final cap v)}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q6024 (SCAST(32 signed \<rightarrow> 32) false) cap) (?S6026 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od) (\<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
(\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
(CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6023 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6025 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R5853 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T5855 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q6024 final cap s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R6023 final cap s)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R5853 final cap s)) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S6026 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T6025 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T5855 final cap v)}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>cap ret__unsigned_long. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b); ret__unsigned_long = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q6024 (SCAST(32 signed \<rightarrow> 32) false) cap) (?G'6060 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)) ret__unsigned_long) [SKIP] (do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od) (\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
(CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6023 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6025 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R5853 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T5855 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q6024 final cap s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R6023 final cap s)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R5853 final cap s)) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := vb\<rparr> \<in> {s. s \<in> ?G'6060 final cap v va vb}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T6025 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T5855 final cap v)}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>cap ret__unsigned_long ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b); ret__unsigned_long = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap); ret__unsigned = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q6024 (SCAST(32 signed \<rightarrow> 32) false) cap) (?G'6278 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)) ret__unsigned_long ret__unsigned) [SKIP] (do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od) (\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
(CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,ret__unsigned_long,ret__unsigned,PTR(unit) \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6023 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6025 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R5853 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T5855 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q6024 final cap s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R6023 final cap s)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R5853 final cap s)) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> ?G'6278 final cap v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T6025 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T5855 final cap v)}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>cap ret__unsigned_long ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b); ret__unsigned_long = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap); ret__unsigned = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap); unsigned_eret_2 = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q6024 (SCAST(32 signed \<rightarrow> 32) false) cap) (?G'6461 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)) ret__unsigned_long ret__unsigned unsigned_eret_2) [SKIP] (do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od) (CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,ret__unsigned_long,ret__unsigned,PTR(unit) unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6023 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6025 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R5853 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T5855 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q6024 final cap s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R6023 final cap s)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R5853 final cap s)) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>vd v'. vd = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vd\<rparr> \<in> {s. s \<in> ?G'6461 final cap v va vb vc vd}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T6025 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T5855 final cap v)}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (8 subgoals):
 1. \<And>cap ret__unsigned_long ret__unsigned unsigned_eret_2 rv xfdc. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b); ret__unsigned_long = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap); ret__unsigned = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap); unsigned_eret_2 = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q6613 cap ret__unsigned_long ret__unsigned unsigned_eret_2 rv) (?Q'6613 cap ret__unsigned_long ret__unsigned unsigned_eret_2 rv xfdc) [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))
 2. \<And>cap ret__unsigned_long ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b); ret__unsigned_long = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap); ret__unsigned = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap); unsigned_eret_2 = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R6622 (SCAST(32 signed \<rightarrow> 32) false) cap\<rbrace> unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp) \<lbrace>?Q6613 cap ret__unsigned_long ret__unsigned unsigned_eret_2\<rbrace>
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6023 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6025 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R5853 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T5855 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 7. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 8. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and ?R6622 final cap) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R6023 final cap s)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R5853 final cap s)) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>vd v'. vd = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vd\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vd) (vptr_'_update (\<lambda>_. vc) (asid_'_update (\<lambda>_. vb) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'6619 final cap v va vb vc vd t rv}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T6025 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T5855 final cap v)}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}}
flex-flex pairs:
\<lambda>cap. ?Q'6619 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap ret__unsigned_long ret__unsigned unsigned_eret_2 t rv. ?Q'6613 cap ret__unsigned_long ret__unsigned unsigned_eret_2 rv (xfdc t) proof (prove)
goal (7 subgoals):
 1. \<And>cap ret__unsigned_long ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b); ret__unsigned_long = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap); ret__unsigned = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap); unsigned_eret_2 = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R6622 (SCAST(32 signed \<rightarrow> 32) false) cap\<rbrace> unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6023 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6025 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R5853 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T5855 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and ?R6622 final cap) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R6023 final cap s)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R5853 final cap s)) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T6025 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T5855 final cap v)}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6023 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6025 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R5853 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T5855 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R6023 final cap s)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R5853 final cap s)) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T6025 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T5855 final cap v)}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6023 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6025 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capVPMappedAddress cp = None
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R5853 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T5855 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R6023 final cap s)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R5853 final cap s)) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T6025 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T5855 final cap v)}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capVPMappedAddress cp = None
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6023 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6025 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R5853 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T5855 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R6023 final cap s)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R5853 final cap s)) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T6025 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T5855 final cap v)}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>cap d v0 v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 Wellformed_C.ARMSmallPage v3)) cap; \<not> is_final; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = 0; cp = arch_capability.PageCap d v0 v1 Wellformed_C.ARMSmallPage v3\<rbrakk> \<Longrightarrow> v3 = None
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6023 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6025 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R5853 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T5855 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R6023 final cap s)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R5853 final cap s)) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T6025 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T5855 final cap v)}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>cap d v0 v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 Wellformed_C.ARMSmallPage v3)) cap; \<not> is_final; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = 0; cp = arch_capability.PageCap d v0 v1 Wellformed_C.ARMSmallPage v3; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> v3 = None
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6023 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6025 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R5853 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T5855 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R6023 final cap s)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R5853 final cap s)) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T6025 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T5855 final cap v)}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>cap d v0 v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 Wellformed_C.ARMSmallPage v3)) cap; \<not> is_final; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = 0; cp = arch_capability.PageCap d v0 v1 Wellformed_C.ARMSmallPage v3; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = 0) = ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = 0)\<rbrakk> \<Longrightarrow> v3 = None
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6023 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6025 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R5853 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T5855 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R6023 final cap s)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R5853 final cap s)) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T6025 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T5855 final cap v)}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6023 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6025 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R5853 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T5855 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R6023 final cap s)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R5853 final cap s)) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T6025 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T5855 final cap v)}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = 0; capVPMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6023 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6025 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) 0) [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R5853 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T5855 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R6023 final cap s)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R5853 final cap s)) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T6025 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T5855 final cap v)}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R5853 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T5855 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R5853 final cap s)) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T5855 final cap v)}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R5853 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T5855 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R5853 final cap s)) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T5855 final cap v)}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q6807 (SCAST(32 signed \<rightarrow> 32) false) cap) (?S6809 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6806 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6808 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q6807 final cap s) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?S6809 final cap v) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q6807 (SCAST(32 signed \<rightarrow> 32) false) cap) (?S6809 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6806 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6808 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q6807 final cap s) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?S6809 final cap v) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q6807 (SCAST(32 signed \<rightarrow> 32) false) cap) (?S6809 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6806 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6808 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q6807 final cap s) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?S6809 final cap v) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q6807 (SCAST(32 signed \<rightarrow> 32) false) cap) (?S6809 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6806 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6808 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q6807 final cap s) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?S6809 final cap v) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap ret__unsigned_long. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; ret__unsigned_long = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q6807 (SCAST(32 signed \<rightarrow> 32) false) cap) (?G'6845 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ret__unsigned_long) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6806 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6808 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q6807 final cap s) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> ?G'6845 final cap v va}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q6807 (SCAST(32 signed \<rightarrow> 32) false) cap) (?G'6845 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6806 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6808 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q6807 final cap s) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> ?G'6845 final cap v va}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q7006 (SCAST(32 signed \<rightarrow> 32) false) cap) (?S7008 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R7005 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T7007 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6806 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6808 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q7006 final cap s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R7005 final cap s)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S7008 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T7007 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (8 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q7006 (SCAST(32 signed \<rightarrow> 32) false) cap) (?S7008 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capVPMappedAddress cp \<noteq> None
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R7005 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T7007 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6806 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6808 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 7. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 8. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q7006 final cap s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R7005 final cap s)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S7008 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T7007 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (8 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capVPMappedAddress cp \<noteq> None
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q7006 (SCAST(32 signed \<rightarrow> 32) false) cap) (?S7008 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R7005 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T7007 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6806 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6808 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 7. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 8. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q7006 final cap s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R7005 final cap s)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S7008 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T7007 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (8 subgoals):
 1. \<And>cap d v0 v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; \<not> is_final; v2 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; cp = arch_capability.PageCap d v0 v1 v2 v3\<rbrakk> \<Longrightarrow> \<exists>a b. v3 = Some (a, b)
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q7006 (SCAST(32 signed \<rightarrow> 32) false) cap) (?S7008 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R7005 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T7007 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6806 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6808 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 7. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 8. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q7006 final cap s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R7005 final cap s)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S7008 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T7007 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (8 subgoals):
 1. \<And>cap d v0 v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; \<not> is_final; v2 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; cp = arch_capability.PageCap d v0 v1 v2 v3; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> \<exists>a b. v3 = Some (a, b)
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q7006 (SCAST(32 signed \<rightarrow> 32) false) cap) (?S7008 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R7005 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T7007 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6806 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6808 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 7. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 8. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q7006 final cap s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R7005 final cap s)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S7008 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T7007 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (8 subgoals):
 1. \<And>cap d v0 v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; \<not> is_final; v2 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; cp = arch_capability.PageCap d v0 v1 v2 v3; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = 0) = ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = 0)\<rbrakk> \<Longrightarrow> \<exists>a b. v3 = Some (a, b)
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q7006 (SCAST(32 signed \<rightarrow> 32) false) cap) (?S7008 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R7005 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T7007 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6806 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6808 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 7. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 8. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q7006 final cap s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R7005 final cap s)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S7008 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T7007 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q7006 (SCAST(32 signed \<rightarrow> 32) false) cap) (?S7008 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R7005 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T7007 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6806 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6808 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q7006 final cap s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R7005 final cap s)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S7008 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T7007 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q7006 (SCAST(32 signed \<rightarrow> 32) false) cap) (?S7008 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od) (\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R7005 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T7007 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6806 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6808 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q7006 final cap s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R7005 final cap s)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S7008 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T7007 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q7006 (SCAST(32 signed \<rightarrow> 32) false) cap) (?S7008 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od) (\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
(\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
(CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R7005 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T7007 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6806 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6808 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q7006 final cap s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R7005 final cap s)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S7008 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T7007 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b); ret__unsigned = capFSize_CL (cap_frame_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q7006 (SCAST(32 signed \<rightarrow> 32) false) cap) (?G'7043 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap)) ret__unsigned) [SKIP] (do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od) (\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
(\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
(CALL unmapPage_'proc(ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R7005 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T7007 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6806 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6808 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q7006 final cap s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R7005 final cap s)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> ?G'7043 final cap v va vb}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T7007 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>cap ret__unsigned ret__unsigned_long. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b); ret__unsigned = capFSize_CL (cap_frame_cap_lift cap); ret__unsigned_long = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q7006 (SCAST(32 signed \<rightarrow> 32) false) cap) (?G'7289 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap)) ret__unsigned ret__unsigned_long) [SKIP] (do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od) (\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
(\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
(CALL unmapPage_'proc(ret__unsigned,ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R7005 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T7007 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6806 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6808 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q7006 final cap s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R7005 final cap s)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := vc\<rparr> \<in> {s. s \<in> ?G'7289 final cap v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T7007 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>cap ret__unsigned ret__unsigned_long unsigned_eret_2. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b); ret__unsigned = capFSize_CL (cap_frame_cap_lift cap); ret__unsigned_long = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap); unsigned_eret_2 = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q7006 (SCAST(32 signed \<rightarrow> 32) false) cap) (?G'7498 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap)) ret__unsigned ret__unsigned_long unsigned_eret_2) [SKIP] (do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od) (\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
(CALL unmapPage_'proc(ret__unsigned,ret__unsigned_long,unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R7005 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T7007 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6806 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6808 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q7006 final cap s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R7005 final cap s)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>vd v'. vd = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vd\<rparr> \<in> {s. s \<in> ?G'7498 final cap v va vb vc vd}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T7007 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>cap ret__unsigned ret__unsigned_long unsigned_eret_2 unsigned_eret_3. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b); ret__unsigned = capFSize_CL (cap_frame_cap_lift cap); ret__unsigned_long = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap); unsigned_eret_2 = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap); unsigned_eret_3 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q7006 (SCAST(32 signed \<rightarrow> 32) false) cap) (?G'7682 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap)) ret__unsigned ret__unsigned_long unsigned_eret_2 unsigned_eret_3) [SKIP] (do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od) (CALL unmapPage_'proc(ret__unsigned,ret__unsigned_long,unsigned_eret_2,PTR(unit) unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R7005 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T7007 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6806 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6808 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q7006 final cap s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R7005 final cap s)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>vd v'. vd = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vd\<rparr> \<in> {s. s \<in> {s. \<forall>ve v'. ve = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := ve\<rparr> \<in> {s. s \<in> ?G'7682 final cap v va vb vc vd ve}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T7007 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (8 subgoals):
 1. \<And>cap ret__unsigned ret__unsigned_long unsigned_eret_2 unsigned_eret_3 rv xfdc. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b); ret__unsigned = capFSize_CL (cap_frame_cap_lift cap); ret__unsigned_long = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap); unsigned_eret_2 = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap); unsigned_eret_3 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q7835 cap ret__unsigned ret__unsigned_long unsigned_eret_2 unsigned_eret_3 rv) (?Q'7835 cap ret__unsigned ret__unsigned_long unsigned_eret_2 unsigned_eret_3 rv xfdc) [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))
 2. \<And>cap ret__unsigned ret__unsigned_long unsigned_eret_2 unsigned_eret_3. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b); ret__unsigned = capFSize_CL (cap_frame_cap_lift cap); ret__unsigned_long = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap); unsigned_eret_2 = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap); unsigned_eret_3 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7844 (SCAST(32 signed \<rightarrow> 32) false) cap\<rbrace> unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp) \<lbrace>?Q7835 cap ret__unsigned ret__unsigned_long unsigned_eret_2 unsigned_eret_3\<rbrace>
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R7005 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T7007 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6806 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6808 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 7. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 8. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and ?R7844 final cap) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R7005 final cap s)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>vd v'. vd = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vd\<rparr> \<in> {s. s \<in> {s. \<forall>ve v'. ve = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := ve\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) ve) (vptr_'_update (\<lambda>_. vd) (asid_'_update (\<lambda>_. vc) (page_size_'_update (\<lambda>_. vb) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'7841 final cap v va vb vc vd ve t rv}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T7007 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}}
flex-flex pairs:
\<lambda>cap. ?Q'7841 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap ret__unsigned ret__unsigned_long unsigned_eret_2 unsigned_eret_3 t rv. ?Q'7835 cap ret__unsigned ret__unsigned_long unsigned_eret_2 unsigned_eret_3 rv (xfdc t) proof (prove)
goal (7 subgoals):
 1. \<And>cap ret__unsigned ret__unsigned_long unsigned_eret_2 unsigned_eret_3. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b); ret__unsigned = capFSize_CL (cap_frame_cap_lift cap); ret__unsigned_long = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap); unsigned_eret_2 = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap); unsigned_eret_3 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R7844 (SCAST(32 signed \<rightarrow> 32) false) cap\<rbrace> unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R7005 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T7007 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6806 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6808 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and ?R7844 final cap) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R7005 final cap s)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T7007 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R7005 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T7007 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6806 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6808 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R7005 final cap s)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T7007 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R7005 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T7007 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capVPMappedAddress cp = None
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6806 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6808 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R7005 final cap s)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T7007 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capVPMappedAddress cp = None
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R7005 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T7007 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6806 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6808 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R7005 final cap s)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T7007 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>cap d v0 v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; \<not> is_final; v2 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = 0; cp = arch_capability.PageCap d v0 v1 v2 v3\<rbrakk> \<Longrightarrow> v3 = None
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R7005 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T7007 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6806 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6808 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R7005 final cap s)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T7007 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>cap d v0 v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; \<not> is_final; v2 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = 0; cp = arch_capability.PageCap d v0 v1 v2 v3; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> v3 = None
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R7005 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T7007 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6806 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6808 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R7005 final cap s)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T7007 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (7 subgoals):
 1. \<And>cap d v0 v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; \<not> is_final; v2 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = 0; cp = arch_capability.PageCap d v0 v1 v2 v3; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = 0) = ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = 0)\<rbrakk> \<Longrightarrow> v3 = None
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R7005 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T7007 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6806 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6808 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 6. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 7. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R7005 final cap s)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T7007 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R7005 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T7007 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6806 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6808 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R7005 final cap s)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T7007 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = 0; capVPMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R7005 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T7007 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap) 0) [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6806 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6808 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R7005 final cap s)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T7007 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6806 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6808 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final; isPageCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R6806 (SCAST(32 signed \<rightarrow> 32) false) cap) (?T6808 (SCAST(32 signed \<rightarrow> 32) false) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (3 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; \<not> is_final\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageDirectoryCap cp
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (2 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. ccap_relation (fst rv) (remainder_C rv') \<and> ccap_relation (snd rv) (finaliseCap_ret_C.cleanupInfo_C rv')) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  IF True THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (2 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?G3359 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'3362 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isASIDPoolCap cp then do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od else if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isASIDPoolCap cp THEN
  \<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2)
ELSE
  IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> ?G3359 final cap s) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> ?G'3362 final cap v} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (3 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isASIDPoolCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q8784 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S8786 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od) (\<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R8783 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T8785 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> ?Q8784 final cap s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> ?R8783 final cap s)) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> ?S8786 final cap v) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> ?T8785 final cap v)}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (3 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isASIDPoolCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q8784 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S8786 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od) (\<acute>ret__unsigned :== CALL cap_asid_pool_cap_get_capASIDBase_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
(CALL deleteASIDPool_'proc(\<acute>ret__unsigned,ap_Ptr \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R8783 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T8785 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> ?Q8784 final cap s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> ?R8783 final cap s)) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> ?S8786 final cap v) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> ?T8785 final cap v)}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (3 subgoals):
 1. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isASIDPoolCap cp; ret__unsigned = capASIDBase_CL (cap_asid_pool_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q8784 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'8806 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ret__unsigned) [SKIP] (do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od) (\<acute>unsigned_eret_2 :== CALL cap_asid_pool_cap_get_capASIDPool_'proc(cap);;
(CALL deleteASIDPool_'proc(ret__unsigned,ap_Ptr \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R8783 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T8785 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> ?Q8784 final cap s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> ?R8783 final cap s)) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>va v'. va = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> ?G'8806 final cap v va}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> ?T8785 final cap v)}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (3 subgoals):
 1. \<And>cap ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isASIDPoolCap cp; ret__unsigned = capASIDBase_CL (cap_asid_pool_cap_lift cap); unsigned_eret_2 = capASIDPool_CL (cap_asid_pool_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q8784 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'8990 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ret__unsigned unsigned_eret_2) [SKIP] (do y <- deleteASIDPool (capASIDBase cp) (capASIDPool cp);
return (capability.NullCap, capability.NullCap)
od) (CALL deleteASIDPool_'proc(ret__unsigned,ap_Ptr unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R8783 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T8785 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> ?Q8784 final cap s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> ?R8783 final cap s)) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>va v'. va = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> ?G'8990 final cap v va vb}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> ?T8785 final cap v)}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap ret__unsigned unsigned_eret_2 rv xfdc. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isASIDPoolCap cp; ret__unsigned = capASIDBase_CL (cap_asid_pool_cap_lift cap); unsigned_eret_2 = capASIDPool_CL (cap_asid_pool_cap_lift cap); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q9135 cap ret__unsigned unsigned_eret_2 rv) (?Q'9135 cap ret__unsigned unsigned_eret_2 rv xfdc) [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))
 2. \<And>cap ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isASIDPoolCap cp; ret__unsigned = capASIDBase_CL (cap_asid_pool_cap_lift cap); unsigned_eret_2 = capASIDPool_CL (cap_asid_pool_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R9144 (SCAST(32 signed \<rightarrow> 32) true) cap\<rbrace> deleteASIDPool (capASIDBase cp) (capASIDPool cp) \<lbrace>?Q9135 cap ret__unsigned unsigned_eret_2\<rbrace>
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R8783 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T8785 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and ?R9144 final cap) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> ?R8783 final cap s)) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>va v'. va = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr vb) (asid_base_'_update (\<lambda>_. va) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'9141 final cap v va vb t rv}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> ?T8785 final cap v)}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}}
flex-flex pairs:
\<lambda>cap. ?Q'9141 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) \<equiv>\<^sup>? \<lambda>cap ret__unsigned unsigned_eret_2 t rv. ?Q'9135 cap ret__unsigned unsigned_eret_2 rv (xfdc t) proof (prove)
goal (3 subgoals):
 1. \<And>cap ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isASIDPoolCap cp; ret__unsigned = capASIDBase_CL (cap_asid_pool_cap_lift cap); unsigned_eret_2 = capASIDPool_CL (cap_asid_pool_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R9144 (SCAST(32 signed \<rightarrow> 32) true) cap\<rbrace> deleteASIDPool (capASIDBase cp) (capASIDPool cp) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R8783 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T8785 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and ?R9144 final cap) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> ?R8783 final cap s)) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> ?T8785 final cap v)}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (2 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R8783 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T8785 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageDirectoryCap cp \<and> (\<exists>y. capPDMappedASID cp = Some y) then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageDirectoryCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> ?R8783 final cap s)) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> ?T8785 final cap v)}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (3 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q9245 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S9247 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> ?Q9245 final cap s) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> ?S9247 final cap v) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (3 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q9245 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S9247 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__int :== 1;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> ?Q9245 final cap s) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> ?S9247 final cap v) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (3 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q9245 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'9266 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF 1 \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> ?Q9245 final cap s) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> ?G'9266 final cap v}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (3 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q9245 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'9266 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF True THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> ?Q9245 final cap s) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> ?G'9266 final cap v}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (3 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q9245 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'9266 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> ?Q9245 final cap s) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> ?G'9266 final cap v}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (3 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q9245 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'9266 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDIsMapped_'proc(cap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> ?Q9245 final cap s) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> ?G'9266 final cap v}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (3 subgoals):
 1. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp; ret__unsigned = capPDIsMapped_CL (cap_page_directory_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q9245 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'9593 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ret__unsigned) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__int :== (if ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> ?Q9245 final cap s) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> ?G'9593 final cap v va}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (3 subgoals):
 1. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp; ret__unsigned = capPDIsMapped_CL (cap_page_directory_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q9245 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'9726 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ret__unsigned) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF (if ret__unsigned \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> ?Q9245 final cap s) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'9726 final cap v va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (3 subgoals):
 1. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp; ret__unsigned = capPDIsMapped_CL (cap_page_directory_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q9245 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'9726 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap))) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> ?Q9245 final cap s) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'9726 final cap v va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp; ret__unsigned = capPDIsMapped_CL (cap_page_directory_cap_lift cap); isPageDirectoryCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q9245 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'9726 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap))) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp; ret__unsigned = capPDIsMapped_CL (cap_page_directory_cap_lift cap)\<rbrakk> \<Longrightarrow> isPageDirectoryCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> ?Q9245 final cap s) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'9726 final cap v va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q9245 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'9726 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap))) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp; ret__unsigned = capPDIsMapped_CL (cap_page_directory_cap_lift cap)\<rbrakk> \<Longrightarrow> isPageDirectoryCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> ?Q9245 final cap s) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'9726 final cap v va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q9951 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S9953 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap))) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9950 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9952 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap))) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp; ret__unsigned = capPDIsMapped_CL (cap_page_directory_cap_lift cap)\<rbrakk> \<Longrightarrow> isPageDirectoryCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q9951 final cap s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R9950 final cap s)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S9953 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T9952 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0; capPDMappedASID cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q9951 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S9953 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap))) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capPDMappedASID cp \<noteq> None
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9950 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9952 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap))) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp; ret__unsigned = capPDIsMapped_CL (cap_page_directory_cap_lift cap)\<rbrakk> \<Longrightarrow> isPageDirectoryCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q9951 final cap s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R9950 final cap s)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S9953 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T9952 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capPDMappedASID cp \<noteq> None
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0; capPDMappedASID cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q9951 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S9953 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap))) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9950 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9952 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap))) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp; ret__unsigned = capPDIsMapped_CL (cap_page_directory_cap_lift cap)\<rbrakk> \<Longrightarrow> isPageDirectoryCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q9951 final cap s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R9950 final cap s)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S9953 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T9952 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap v0 v1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap v0 v1)) cap; is_final; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0; cp = arch_capability.PageDirectoryCap v0 v1\<rbrakk> \<Longrightarrow> \<exists>y. v1 = Some y
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0; capPDMappedASID cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q9951 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S9953 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap))) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9950 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9952 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap))) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp; ret__unsigned = capPDIsMapped_CL (cap_page_directory_cap_lift cap)\<rbrakk> \<Longrightarrow> isPageDirectoryCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q9951 final cap s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R9950 final cap s)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S9953 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T9952 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap v0 v1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap v0 v1)) cap; is_final; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0; cp = arch_capability.PageDirectoryCap v0 v1; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap\<rbrakk> \<Longrightarrow> \<exists>y. v1 = Some y
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0; capPDMappedASID cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q9951 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S9953 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap))) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9950 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9952 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap))) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp; ret__unsigned = capPDIsMapped_CL (cap_page_directory_cap_lift cap)\<rbrakk> \<Longrightarrow> isPageDirectoryCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q9951 final cap s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R9950 final cap s)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S9953 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T9952 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap v0 v1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap v0 v1)) cap; is_final; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0; cp = arch_capability.PageDirectoryCap v0 v1; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; cap_lift cap = Some (Cap_page_directory_cap \<lparr>capPDMappedASID_CL = (cap_C.words_C cap.[1] >> 0) && mask 17, capPDIsMapped_CL = (cap_C.words_C cap.[0] >> 4) && mask 1, capPDBasePtr_CL = (cap_C.words_C cap.[0] << 0) && ~~ mask 14\<rparr>)\<rbrakk> \<Longrightarrow> \<exists>y. v1 = Some y
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0; capPDMappedASID cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q9951 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S9953 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap))) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9950 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9952 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap))) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp; ret__unsigned = capPDIsMapped_CL (cap_page_directory_cap_lift cap)\<rbrakk> \<Longrightarrow> isPageDirectoryCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q9951 final cap s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R9950 final cap s)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S9953 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T9952 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0; capPDMappedASID cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q9951 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S9953 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap))) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9950 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9952 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap))) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp; ret__unsigned = capPDIsMapped_CL (cap_page_directory_cap_lift cap)\<rbrakk> \<Longrightarrow> isPageDirectoryCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q9951 final cap s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R9950 final cap s)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S9953 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T9952 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0; \<exists>y. capPDMappedASID cp = Some y\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q9951 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S9953 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap))) [SKIP] (do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od) (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9950 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9952 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap))) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp; ret__unsigned = capPDIsMapped_CL (cap_page_directory_cap_lift cap)\<rbrakk> \<Longrightarrow> isPageDirectoryCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q9951 final cap s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R9950 final cap s)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S9953 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T9952 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0; \<exists>y. capPDMappedASID cp = Some y\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q9951 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S9953 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap))) [SKIP] (do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od) (\<acute>ret__unsigned :== CALL cap_page_directory_cap_get_capPDMappedASID_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
(CALL deleteASID_'proc(\<acute>ret__unsigned,pde_Ptr \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9950 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9952 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap))) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp; ret__unsigned = capPDIsMapped_CL (cap_page_directory_cap_lift cap)\<rbrakk> \<Longrightarrow> isPageDirectoryCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q9951 final cap s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R9950 final cap s)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S9953 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T9952 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0; \<exists>y. capPDMappedASID cp = Some y; ret__unsigned = capPDMappedASID_CL (cap_page_directory_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q9951 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'9977 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap)) ret__unsigned) [SKIP] (do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od) (\<acute>unsigned_eret_2 :== CALL cap_page_directory_cap_get_capPDBasePtr_'proc(cap);;
(CALL deleteASID_'proc(ret__unsigned,pde_Ptr \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9950 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9952 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap))) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp; ret__unsigned = capPDIsMapped_CL (cap_page_directory_cap_lift cap)\<rbrakk> \<Longrightarrow> isPageDirectoryCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q9951 final cap s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R9950 final cap s)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> ?G'9977 final cap v va vb}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T9952 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0; \<exists>y. capPDMappedASID cp = Some y; ret__unsigned = capPDMappedASID_CL (cap_page_directory_cap_lift cap); unsigned_eret_2 = capPDBasePtr_CL (cap_page_directory_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q9951 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'10166 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap)) ret__unsigned unsigned_eret_2) [SKIP] (do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od) (CALL deleteASID_'proc(ret__unsigned,pde_Ptr unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9950 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9952 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap))) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp; ret__unsigned = capPDIsMapped_CL (cap_page_directory_cap_lift cap)\<rbrakk> \<Longrightarrow> isPageDirectoryCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q9951 final cap s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R9950 final cap s)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> ?G'10166 final cap v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T9952 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap ret__unsigned unsigned_eret_2 rv xfdc. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0; \<exists>y. capPDMappedASID cp = Some y; ret__unsigned = capPDMappedASID_CL (cap_page_directory_cap_lift cap); unsigned_eret_2 = capPDBasePtr_CL (cap_page_directory_cap_lift cap); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q10316 cap ret__unsigned unsigned_eret_2 rv) (?Q'10316 cap ret__unsigned unsigned_eret_2 rv xfdc) [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))
 2. \<And>cap ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0; \<exists>y. capPDMappedASID cp = Some y; ret__unsigned = capPDMappedASID_CL (cap_page_directory_cap_lift cap); unsigned_eret_2 = capPDBasePtr_CL (cap_page_directory_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R10325 (SCAST(32 signed \<rightarrow> 32) true) cap\<rbrace> deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp) \<lbrace>?Q10316 cap ret__unsigned unsigned_eret_2\<rbrace>
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9950 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9952 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap))) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp; ret__unsigned = capPDIsMapped_CL (cap_page_directory_cap_lift cap)\<rbrakk> \<Longrightarrow> isPageDirectoryCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and ?R10325 final cap) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R9950 final cap s)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr vc) (asid_'_update (\<lambda>_. vb) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'10322 final cap v va vb vc t rv}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T9952 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}}
flex-flex pairs:
\<lambda>cap. ?Q'10322 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap ret__unsigned unsigned_eret_2 t rv. ?Q'10316 cap ret__unsigned unsigned_eret_2 rv (xfdc t) proof (prove)
goal (5 subgoals):
 1. \<And>cap ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0; \<exists>y. capPDMappedASID cp = Some y; ret__unsigned = capPDMappedASID_CL (cap_page_directory_cap_lift cap); unsigned_eret_2 = capPDBasePtr_CL (cap_page_directory_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R10325 (SCAST(32 signed \<rightarrow> 32) true) cap\<rbrace> deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9950 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9952 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap))) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp; ret__unsigned = capPDIsMapped_CL (cap_page_directory_cap_lift cap)\<rbrakk> \<Longrightarrow> isPageDirectoryCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and ?R10325 final cap) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R9950 final cap s)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T9952 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9950 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9952 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap))) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp; ret__unsigned = capPDIsMapped_CL (cap_page_directory_cap_lift cap)\<rbrakk> \<Longrightarrow> isPageDirectoryCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R9950 final cap s)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T9952 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0; capPDMappedASID cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9950 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9952 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap))) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capPDMappedASID cp = None
 3. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp; ret__unsigned = capPDIsMapped_CL (cap_page_directory_cap_lift cap)\<rbrakk> \<Longrightarrow> isPageDirectoryCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R9950 final cap s)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T9952 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capPDMappedASID cp = None
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0; capPDMappedASID cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9950 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9952 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap))) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp; ret__unsigned = capPDIsMapped_CL (cap_page_directory_cap_lift cap)\<rbrakk> \<Longrightarrow> isPageDirectoryCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R9950 final cap s)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T9952 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap v0 v1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap v0 v1)) cap; is_final; capPDIsMapped_CL (cap_page_directory_cap_lift cap) = 0; cp = arch_capability.PageDirectoryCap v0 v1\<rbrakk> \<Longrightarrow> v1 = None
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0; capPDMappedASID cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9950 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9952 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap))) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp; ret__unsigned = capPDIsMapped_CL (cap_page_directory_cap_lift cap)\<rbrakk> \<Longrightarrow> isPageDirectoryCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R9950 final cap s)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T9952 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap v0 v1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap v0 v1)) cap; is_final; capPDIsMapped_CL (cap_page_directory_cap_lift cap) = 0; cp = arch_capability.PageDirectoryCap v0 v1; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap\<rbrakk> \<Longrightarrow> v1 = None
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0; capPDMappedASID cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9950 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9952 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap))) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp; ret__unsigned = capPDIsMapped_CL (cap_page_directory_cap_lift cap)\<rbrakk> \<Longrightarrow> isPageDirectoryCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R9950 final cap s)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T9952 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap v0 v1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap v0 v1)) cap; is_final; capPDIsMapped_CL (cap_page_directory_cap_lift cap) = 0; cp = arch_capability.PageDirectoryCap v0 v1; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; cap_lift cap = Some (Cap_page_directory_cap \<lparr>capPDMappedASID_CL = (cap_C.words_C cap.[1] >> 0) && mask 17, capPDIsMapped_CL = (cap_C.words_C cap.[0] >> 4) && mask 1, capPDBasePtr_CL = (cap_C.words_C cap.[0] << 0) && ~~ mask 14\<rparr>)\<rbrakk> \<Longrightarrow> v1 = None
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0; capPDMappedASID cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9950 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9952 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap))) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp; ret__unsigned = capPDIsMapped_CL (cap_page_directory_cap_lift cap)\<rbrakk> \<Longrightarrow> isPageDirectoryCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R9950 final cap s)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T9952 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0; capPDMappedASID cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9950 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9952 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPDIsMapped_CL (cap_page_directory_cap_lift cap))) [SKIP] (if \<exists>y. capPDMappedASID cp = Some y then do y <- deleteASID (the (capPDMappedASID cp)) (capPDBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp; ret__unsigned = capPDIsMapped_CL (cap_page_directory_cap_lift cap)\<rbrakk> \<Longrightarrow> isPageDirectoryCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R9950 final cap s)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T9952 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPDIsMapped_CL (cap_page_directory_cap_lift cap) = 0; capPDMappedASID cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9950 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9952 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) 0) [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))
 2. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp; ret__unsigned = capPDIsMapped_CL (cap_page_directory_cap_lift cap)\<rbrakk> \<Longrightarrow> isPageDirectoryCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R9950 final cap s)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T9952 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (3 subgoals):
 1. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; isPageDirectoryCap cp; ret__unsigned = capPDIsMapped_CL (cap_page_directory_cap_lift cap)\<rbrakk> \<Longrightarrow> isPageDirectoryCap cp \<longrightarrow> \<not> isPageTableCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (2 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R9244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T9246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageTableCap cp THEN
  \<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> ?R9244 final cap s))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> ?T9246 final cap v)})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (3 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q10504 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S10506 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> ?Q10504 final cap s) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> ?S10506 final cap v) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp; isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q10504 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S10506 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> ?Q10504 final cap s) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> ?S10506 final cap v) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q10504 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S10506 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__int :== 1;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> ?Q10504 final cap s) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> ?S10506 final cap v) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q10504 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S10506 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__int :== 1;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> ?Q10504 final cap s) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> ?S10506 final cap v) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q10504 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'10539 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF 1 \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> ?Q10504 final cap s) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> ?G'10539 final cap v}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q10504 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'10539 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> ?Q10504 final cap s) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> ?G'10539 final cap v}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q10504 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'10539 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(cap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> ?Q10504 final cap s) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> ?G'10539 final cap v}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q10504 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'10889 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ret__unsigned) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__int :== (if ret__unsigned \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> ?Q10504 final cap s) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> ?G'10889 final cap v va}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q10504 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'11037 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ret__unsigned) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF (if ret__unsigned \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> ?Q10504 final cap s) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'11037 final cap v va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q10504 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'11037 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPTIsMapped_CL (cap_page_table_cap_lift cap))) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> ?Q10504 final cap s) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'11037 final cap v va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q11289 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S11291 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPTIsMapped_CL (cap_page_table_cap_lift cap))) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R11288 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T11290 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPTIsMapped_CL (cap_page_table_cap_lift cap))) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q11289 final cap s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R11288 final cap s)) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S11291 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T11290 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0; capPTMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q11289 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S11291 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPTIsMapped_CL (cap_page_table_cap_lift cap))) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capPTMappedAddress cp \<noteq> None
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R11288 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T11290 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPTIsMapped_CL (cap_page_table_cap_lift cap))) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q11289 final cap s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R11288 final cap s)) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S11291 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T11290 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capPTMappedAddress cp \<noteq> None
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0; capPTMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q11289 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S11291 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPTIsMapped_CL (cap_page_table_cap_lift cap))) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R11288 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T11290 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPTIsMapped_CL (cap_page_table_cap_lift cap))) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q11289 final cap s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R11288 final cap s)) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S11291 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T11290 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap v0 v1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap v0 v1)) cap; is_final; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0; cp = arch_capability.PageTableCap v0 v1\<rbrakk> \<Longrightarrow> \<exists>a b. v1 = Some (a, b)
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0; capPTMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q11289 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S11291 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPTIsMapped_CL (cap_page_table_cap_lift cap))) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R11288 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T11290 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPTIsMapped_CL (cap_page_table_cap_lift cap))) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q11289 final cap s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R11288 final cap s)) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S11291 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T11290 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap v0 v1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap v0 v1)) cap; is_final; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0; cp = arch_capability.PageTableCap v0 v1; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap\<rbrakk> \<Longrightarrow> \<exists>a b. v1 = Some (a, b)
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0; capPTMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q11289 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S11291 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPTIsMapped_CL (cap_page_table_cap_lift cap))) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R11288 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T11290 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPTIsMapped_CL (cap_page_table_cap_lift cap))) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q11289 final cap s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R11288 final cap s)) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S11291 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T11290 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap v0 v1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap v0 v1)) cap; is_final; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0; cp = arch_capability.PageTableCap v0 v1; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; cap_lift cap = Some (Cap_page_table_cap \<lparr>capPTIsMapped_CL = (cap_C.words_C cap.[1] >> 29) && mask 1, capPTMappedASID_CL = (cap_C.words_C cap.[1] >> 12) && mask 17, capPTMappedAddress_CL = (cap_C.words_C cap.[1] << 20) && ~~ mask 20, capPTBasePtr_CL = (cap_C.words_C cap.[0] << 0) && ~~ mask 10\<rparr>)\<rbrakk> \<Longrightarrow> \<exists>a b. v1 = Some (a, b)
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0; capPTMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q11289 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S11291 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPTIsMapped_CL (cap_page_table_cap_lift cap))) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R11288 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T11290 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPTIsMapped_CL (cap_page_table_cap_lift cap))) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q11289 final cap s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R11288 final cap s)) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S11291 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T11290 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0; capPTMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q11289 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S11291 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPTIsMapped_CL (cap_page_table_cap_lift cap))) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R11288 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T11290 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPTIsMapped_CL (cap_page_table_cap_lift cap))) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q11289 final cap s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R11288 final cap s)) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S11291 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T11290 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0; \<exists>a b. capPTMappedAddress cp = Some (a, b)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q11289 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S11291 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPTIsMapped_CL (cap_page_table_cap_lift cap))) [SKIP] (do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od) (\<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R11288 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T11290 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPTIsMapped_CL (cap_page_table_cap_lift cap))) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q11289 final cap s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R11288 final cap s)) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S11291 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T11290 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0; \<exists>a b. capPTMappedAddress cp = Some (a, b)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q11289 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S11291 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPTIsMapped_CL (cap_page_table_cap_lift cap))) [SKIP] (do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od) (\<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
(\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
(CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R11288 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T11290 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPTIsMapped_CL (cap_page_table_cap_lift cap))) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q11289 final cap s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R11288 final cap s)) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S11291 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T11290 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0; \<exists>a b. capPTMappedAddress cp = Some (a, b); ret__unsigned = capPTMappedASID_CL (cap_page_table_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q11289 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'11317 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPTIsMapped_CL (cap_page_table_cap_lift cap)) ret__unsigned) [SKIP] (do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od) (\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(cap);;
(\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
(CALL unmapPageTable_'proc(ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R11288 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T11290 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPTIsMapped_CL (cap_page_table_cap_lift cap))) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q11289 final cap s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R11288 final cap s)) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> ?G'11317 final cap v va vb}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T11290 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0; \<exists>a b. capPTMappedAddress cp = Some (a, b); ret__unsigned = capPTMappedASID_CL (cap_page_table_cap_lift cap); unsigned_eret_2 = capPTMappedAddress_CL (cap_page_table_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q11289 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'11534 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPTIsMapped_CL (cap_page_table_cap_lift cap)) ret__unsigned unsigned_eret_2) [SKIP] (do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od) (\<acute>unsigned_eret_3 :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(cap);;
(CALL unmapPageTable_'proc(ret__unsigned,unsigned_eret_2,pte_Ptr \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R11288 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T11290 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPTIsMapped_CL (cap_page_table_cap_lift cap))) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q11289 final cap s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R11288 final cap s)) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> ?G'11534 final cap v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T11290 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap ret__unsigned unsigned_eret_2 unsigned_eret_3. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0; \<exists>a b. capPTMappedAddress cp = Some (a, b); ret__unsigned = capPTMappedASID_CL (cap_page_table_cap_lift cap); unsigned_eret_2 = capPTMappedAddress_CL (cap_page_table_cap_lift cap); unsigned_eret_3 = capPTBasePtr_CL (cap_page_table_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q11289 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'11716 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPTIsMapped_CL (cap_page_table_cap_lift cap)) ret__unsigned unsigned_eret_2 unsigned_eret_3) [SKIP] (do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od) (CALL unmapPageTable_'proc(ret__unsigned,unsigned_eret_2,pte_Ptr unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R11288 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T11290 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPTIsMapped_CL (cap_page_table_cap_lift cap))) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q11289 final cap s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R11288 final cap s)) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>vd v'. vd = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vd\<rparr> \<in> {s. s \<in> ?G'11716 final cap v va vb vc vd}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T11290 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap ret__unsigned unsigned_eret_2 unsigned_eret_3. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0; \<exists>a b. capPTMappedAddress cp = Some (a, b); ret__unsigned = capPTMappedASID_CL (cap_page_table_cap_lift cap); unsigned_eret_2 = capPTMappedAddress_CL (cap_page_table_cap_lift cap); unsigned_eret_3 = capPTBasePtr_CL (cap_page_table_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q11289 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'11716 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPTIsMapped_CL (cap_page_table_cap_lift cap)) (capPTMappedASID_CL (cap_page_table_cap_lift cap)) (capPTMappedAddress_CL (cap_page_table_cap_lift cap)) (capPTBasePtr_CL (cap_page_table_cap_lift cap))) [SKIP] (do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od) (CALL unmapPageTable_'proc(capPTMappedASID_CL (cap_page_table_cap_lift cap),capPTMappedAddress_CL (cap_page_table_cap_lift cap),pte_Ptr (capPTBasePtr_CL (cap_page_table_cap_lift cap)));;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R11288 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T11290 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPTIsMapped_CL (cap_page_table_cap_lift cap))) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q11289 final cap s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R11288 final cap s)) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>vd v'. vd = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vd\<rparr> \<in> {s. s \<in> ?G'11716 final cap v va vb vc vd}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T11290 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap ret__unsigned unsigned_eret_2 unsigned_eret_3 rv xfdc. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0; \<exists>a b. capPTMappedAddress cp = Some (a, b); ret__unsigned = capPTMappedASID_CL (cap_page_table_cap_lift cap); unsigned_eret_2 = capPTMappedAddress_CL (cap_page_table_cap_lift cap); unsigned_eret_3 = capPTBasePtr_CL (cap_page_table_cap_lift cap); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q11868 cap ret__unsigned unsigned_eret_2 unsigned_eret_3 rv) (?Q'11882 cap rv xfdc) [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))
 2. \<And>cap ret__unsigned unsigned_eret_2 unsigned_eret_3. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0; \<exists>a b. capPTMappedAddress cp = Some (a, b); ret__unsigned = capPTMappedASID_CL (cap_page_table_cap_lift cap); unsigned_eret_2 = capPTMappedAddress_CL (cap_page_table_cap_lift cap); unsigned_eret_3 = capPTBasePtr_CL (cap_page_table_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R11876 (SCAST(32 signed \<rightarrow> 32) true) cap\<rbrace> unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp) \<lbrace>?Q11868 cap ret__unsigned unsigned_eret_2 unsigned_eret_3\<rbrace>
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R11288 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T11290 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPTIsMapped_CL (cap_page_table_cap_lift cap))) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and ?R11876 final cap) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R11288 final cap s)) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>vd v'. vd = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vd\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vd) (vaddr_'_update (\<lambda>_. vc) (asid_'_update (\<lambda>_. vb) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'11881 final cap v va vb vc vd t rv}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T11290 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}}
flex-flex pairs:
\<lambda>cap t rv. ?Q'11882 cap rv (xfdc t) \<equiv>\<^sup>? \<lambda>cap. ?Q'11881 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPTIsMapped_CL (cap_page_table_cap_lift cap)) (capPTMappedASID_CL (cap_page_table_cap_lift cap)) (capPTMappedAddress_CL (cap_page_table_cap_lift cap)) (capPTBasePtr_CL (cap_page_table_cap_lift cap)) proof (prove)
goal (5 subgoals):
 1. \<And>cap ret__unsigned unsigned_eret_2 unsigned_eret_3. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0; \<exists>a b. capPTMappedAddress cp = Some (a, b); ret__unsigned = capPTMappedASID_CL (cap_page_table_cap_lift cap); unsigned_eret_2 = capPTMappedAddress_CL (cap_page_table_cap_lift cap); unsigned_eret_3 = capPTBasePtr_CL (cap_page_table_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R11876 (SCAST(32 signed \<rightarrow> 32) true) cap\<rbrace> unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R11288 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T11290 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPTIsMapped_CL (cap_page_table_cap_lift cap))) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and ?R11876 final cap) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R11288 final cap s)) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T11290 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; \<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R11288 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T11290 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) (capPTIsMapped_CL (cap_page_table_cap_lift cap))) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R11288 final cap s)) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T11290 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPTIsMapped_CL (cap_page_table_cap_lift cap) = 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R11288 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T11290 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) 0) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R11288 final cap s)) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T11290 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPTIsMapped_CL (cap_page_table_cap_lift cap) = 0; capPTMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R11288 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T11290 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) 0) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPTIsMapped_CL (cap_page_table_cap_lift cap) = 0\<rbrakk> \<Longrightarrow> capPTMappedAddress cp = None
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R11288 final cap s)) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T11290 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPTIsMapped_CL (cap_page_table_cap_lift cap) = 0\<rbrakk> \<Longrightarrow> capPTMappedAddress cp = None
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPTIsMapped_CL (cap_page_table_cap_lift cap) = 0; capPTMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R11288 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T11290 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) 0) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R11288 final cap s)) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T11290 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap v0 v1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap v0 v1)) cap; is_final; capPTIsMapped_CL (cap_page_table_cap_lift cap) = 0; cp = arch_capability.PageTableCap v0 v1\<rbrakk> \<Longrightarrow> v1 = None
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPTIsMapped_CL (cap_page_table_cap_lift cap) = 0; capPTMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R11288 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T11290 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) 0) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R11288 final cap s)) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T11290 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap v0 v1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap v0 v1)) cap; is_final; capPTIsMapped_CL (cap_page_table_cap_lift cap) = 0; cp = arch_capability.PageTableCap v0 v1; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap\<rbrakk> \<Longrightarrow> v1 = None
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPTIsMapped_CL (cap_page_table_cap_lift cap) = 0; capPTMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R11288 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T11290 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) 0) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R11288 final cap s)) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T11290 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap v0 v1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap v0 v1)) cap; is_final; capPTIsMapped_CL (cap_page_table_cap_lift cap) = 0; cp = arch_capability.PageTableCap v0 v1; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; cap_lift cap = Some (Cap_page_table_cap \<lparr>capPTIsMapped_CL = (cap_C.words_C cap.[1] >> 29) && mask 1, capPTMappedASID_CL = (cap_C.words_C cap.[1] >> 12) && mask 17, capPTMappedAddress_CL = (cap_C.words_C cap.[1] << 20) && ~~ mask 20, capPTBasePtr_CL = (cap_C.words_C cap.[0] << 0) && ~~ mask 10\<rparr>)\<rbrakk> \<Longrightarrow> v1 = None
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPTIsMapped_CL (cap_page_table_cap_lift cap) = 0; capPTMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R11288 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T11290 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) 0) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R11288 final cap s)) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T11290 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPTIsMapped_CL (cap_page_table_cap_lift cap) = 0; capPTMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R11288 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T11290 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) 0) [SKIP] (if \<exists>a b. capPTMappedAddress cp = Some (a, b) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R11288 final cap s)) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T11290 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageTableCap cp; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageCap cp; capPTIsMapped_CL (cap_page_table_cap_lift cap) = 0; capPTMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R11288 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T11290 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) 0) [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R11288 final cap s)) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>va v'. va = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if va \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T11290 final cap v va)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (3 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; isPageTableCap cp\<rbrakk> \<Longrightarrow> isPageTableCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageCap cp
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (2 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R10503 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T10505 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI
ELSE
  IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> ?R10503 final cap s)))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> ?T10505 final cap v)})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (3 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q12072 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S12074 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12071 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12073 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ?Q12072 final cap s) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> ?R12071 final cap s))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?S12074 final cap v) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T12073 final cap v)})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage; isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q12072 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S12074 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12071 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12073 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ?Q12072 final cap s) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> ?R12071 final cap s))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?S12074 final cap v) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T12073 final cap v)})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q12072 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S12074 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12071 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12073 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ?Q12072 final cap s) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> ?R12071 final cap s))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?S12074 final cap v) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T12073 final cap v)})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q12072 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S12074 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12071 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12073 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ?Q12072 final cap s) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> ?R12071 final cap s))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?S12074 final cap v) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T12073 final cap v)})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap ret__unsigned_long. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; ret__unsigned_long = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q12072 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'12112 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ret__unsigned_long) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12071 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12073 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ?Q12072 final cap s) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> ?R12071 final cap s))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> ?G'12112 final cap v va}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T12073 final cap v)})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q12072 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'12112 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12071 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12073 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ?Q12072 final cap s) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> ?R12071 final cap s))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> ?G'12112 final cap v va}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T12073 final cap v)})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q12245 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S12247 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12071 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12073 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q12245 final cap s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R12244 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> ?R12071 final cap s))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S12247 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T12246 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T12073 final cap v)})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q12245 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S12247 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capVPMappedAddress cp \<noteq> None
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12071 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12073 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q12245 final cap s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R12244 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> ?R12071 final cap s))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S12247 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T12246 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T12073 final cap v)})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capVPMappedAddress cp \<noteq> None
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q12245 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S12247 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12071 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12073 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q12245 final cap s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R12244 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> ?R12071 final cap s))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S12247 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T12246 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T12073 final cap v)})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap d v0 v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 Wellformed_C.ARMSmallPage v3)) cap; is_final; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; cp = arch_capability.PageCap d v0 v1 Wellformed_C.ARMSmallPage v3\<rbrakk> \<Longrightarrow> \<exists>a b. v3 = Some (a, b)
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q12245 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S12247 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12071 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12073 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q12245 final cap s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R12244 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> ?R12071 final cap s))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S12247 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T12246 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T12073 final cap v)})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap d v0 v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 Wellformed_C.ARMSmallPage v3)) cap; is_final; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; cp = arch_capability.PageCap d v0 v1 Wellformed_C.ARMSmallPage v3; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> \<exists>a b. v3 = Some (a, b)
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q12245 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S12247 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12071 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12073 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q12245 final cap s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R12244 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> ?R12071 final cap s))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S12247 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T12246 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T12073 final cap v)})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap d v0 v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 Wellformed_C.ARMSmallPage v3)) cap; is_final; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; cp = arch_capability.PageCap d v0 v1 Wellformed_C.ARMSmallPage v3; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = 0) = ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = 0)\<rbrakk> \<Longrightarrow> \<exists>a b. v3 = Some (a, b)
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q12245 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S12247 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12071 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12073 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q12245 final cap s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R12244 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> ?R12071 final cap s))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S12247 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T12246 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T12073 final cap v)})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q12245 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S12247 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12071 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12073 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q12245 final cap s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R12244 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> ?R12071 final cap s))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S12247 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T12246 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T12073 final cap v)})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q12245 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S12247 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od) (\<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12071 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12073 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q12245 final cap s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R12244 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> ?R12071 final cap s))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S12247 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T12246 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T12073 final cap v)})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q12245 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S12247 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od) (\<acute>ret__unsigned_long :== CALL cap_small_frame_cap_get_capFMappedASID_'proc(cap);;
(\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
(CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,\<acute>ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12071 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12073 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q12245 final cap s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R12244 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> ?R12071 final cap s))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S12247 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T12246 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T12073 final cap v)})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap ret__unsigned_long. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b); ret__unsigned_long = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q12245 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'12281 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)) ret__unsigned_long) [SKIP] (do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od) (\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFMappedAddress_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
(CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,ret__unsigned_long,\<acute>ret__unsigned,PTR(unit) \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12071 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12073 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q12245 final cap s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R12244 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> ?R12071 final cap s))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := vb\<rparr> \<in> {s. s \<in> ?G'12281 final cap v va vb}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T12246 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T12073 final cap v)})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap ret__unsigned_long ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b); ret__unsigned_long = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap); ret__unsigned = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q12245 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'12499 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)) ret__unsigned_long ret__unsigned) [SKIP] (do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od) (\<acute>unsigned_eret_2 :== CALL cap_small_frame_cap_get_capFBasePtr_'proc(cap);;
(CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,ret__unsigned_long,ret__unsigned,PTR(unit) \<acute>unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12071 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12073 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q12245 final cap s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R12244 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> ?R12071 final cap s))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> ?G'12499 final cap v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T12246 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T12073 final cap v)})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap ret__unsigned_long ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b); ret__unsigned_long = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap); ret__unsigned = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap); unsigned_eret_2 = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q12245 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'12682 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)) ret__unsigned_long ret__unsigned unsigned_eret_2) [SKIP] (do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od) (CALL unmapPage_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage,ret__unsigned_long,ret__unsigned,PTR(unit) unsigned_eret_2);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12071 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12073 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q12245 final cap s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R12244 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> ?R12071 final cap s))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>vd v'. vd = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vd\<rparr> \<in> {s. s \<in> ?G'12682 final cap v va vb vc vd}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T12246 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T12073 final cap v)})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap ret__unsigned_long ret__unsigned unsigned_eret_2 rv xfdc. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b); ret__unsigned_long = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap); ret__unsigned = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap); unsigned_eret_2 = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q12834 cap ret__unsigned_long ret__unsigned unsigned_eret_2 rv) (?Q'12834 cap ret__unsigned_long ret__unsigned unsigned_eret_2 rv xfdc) [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))
 2. \<And>cap ret__unsigned_long ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b); ret__unsigned_long = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap); ret__unsigned = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap); unsigned_eret_2 = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R12843 (SCAST(32 signed \<rightarrow> 32) true) cap\<rbrace> unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp) \<lbrace>?Q12834 cap ret__unsigned_long ret__unsigned unsigned_eret_2\<rbrace>
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12071 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12073 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and ?R12843 final cap) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R12244 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> ?R12071 final cap s))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>vd v'. vd = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vd\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vd) (vptr_'_update (\<lambda>_. vc) (asid_'_update (\<lambda>_. vb) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'12840 final cap v va vb vc vd t rv}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T12246 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T12073 final cap v)})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}}
flex-flex pairs:
\<lambda>cap. ?Q'12840 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap ret__unsigned_long ret__unsigned unsigned_eret_2 t rv. ?Q'12834 cap ret__unsigned_long ret__unsigned unsigned_eret_2 rv (xfdc t) proof (prove)
goal (5 subgoals):
 1. \<And>cap ret__unsigned_long ret__unsigned unsigned_eret_2. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b); ret__unsigned_long = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap); ret__unsigned = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap); unsigned_eret_2 = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R12843 (SCAST(32 signed \<rightarrow> 32) true) cap\<rbrace> unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12071 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12073 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and ?R12843 final cap) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R12244 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> ?R12071 final cap s))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T12246 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T12073 final cap v)})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12071 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12073 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R12244 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> ?R12071 final cap s))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T12246 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T12073 final cap v)})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capVPMappedAddress cp = None
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12071 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12073 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R12244 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> ?R12071 final cap s))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T12246 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T12073 final cap v)})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capVPMappedAddress cp = None
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12071 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12073 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R12244 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> ?R12071 final cap s))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T12246 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T12073 final cap v)})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap d v0 v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 Wellformed_C.ARMSmallPage v3)) cap; is_final; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = 0; cp = arch_capability.PageCap d v0 v1 Wellformed_C.ARMSmallPage v3\<rbrakk> \<Longrightarrow> v3 = None
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12071 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12073 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R12244 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> ?R12071 final cap s))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T12246 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T12073 final cap v)})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap d v0 v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 Wellformed_C.ARMSmallPage v3)) cap; is_final; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = 0; cp = arch_capability.PageCap d v0 v1 Wellformed_C.ARMSmallPage v3; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> v3 = None
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12071 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12073 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R12244 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> ?R12071 final cap s))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T12246 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T12073 final cap v)})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap d v0 v1 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 Wellformed_C.ARMSmallPage v3)) cap; is_final; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = 0; cp = arch_capability.PageCap d v0 v1 Wellformed_C.ARMSmallPage v3; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = 0) = ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = 0)\<rbrakk> \<Longrightarrow> v3 = None
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12071 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12073 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R12244 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> ?R12071 final cap s))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T12246 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T12073 final cap v)})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage Wellformed_C.ARMSmallPage (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12071 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12073 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R12244 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> ?R12071 final cap s))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T12246 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T12073 final cap v)})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp = Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = 0; capVPMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12244 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12246 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) 0) [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12071 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12073 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R12244 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> ?R12071 final cap s))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T12246 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T12073 final cap v)})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (3 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12071 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12073 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> ?R12071 final cap s))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T12073 final cap v)})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (2 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R12071 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T12073 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage THEN
  \<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> ?R12071 final cap s))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T12073 final cap v)})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (3 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q13028 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S13030 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); \<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13027 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13029 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q13028 final cap s) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> ?R13027 final cap s)))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?S13030 final cap v) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T13029 final cap v)})})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q13028 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S13030 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); \<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13027 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13029 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q13028 final cap s) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> ?R13027 final cap s)))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?S13030 final cap v) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T13029 final cap v)})})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q13028 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S13030 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); \<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13027 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13029 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q13028 final cap s) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> ?R13027 final cap s)))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?S13030 final cap v) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T13029 final cap v)})})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q13028 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S13030 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); \<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13027 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13029 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q13028 final cap s) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> ?R13027 final cap s)))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?S13030 final cap v) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T13029 final cap v)})})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap ret__unsigned_long. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; ret__unsigned_long = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q13028 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'13073 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ret__unsigned_long) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); \<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13027 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13029 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q13028 final cap s) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> ?R13027 final cap s)))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> ?G'13073 final cap v va}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T13029 final cap v)})})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q13028 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'13073 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (IF (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3)
FI;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); \<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13027 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13029 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?Q13028 final cap s) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> ?R13027 final cap s)))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> ?G'13073 final cap v va}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T13029 final cap v)})})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q13234 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S13236 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13233 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13235 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); \<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13027 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13029 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q13234 final cap s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R13233 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> ?R13027 final cap s)))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S13236 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T13235 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T13029 final cap v)})})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q13234 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S13236 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capVPMappedAddress cp \<noteq> None
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13233 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13235 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); \<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13027 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13029 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q13234 final cap s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R13233 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> ?R13027 final cap s)))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S13236 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T13235 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T13029 final cap v)})})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capVPMappedAddress cp \<noteq> None
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q13234 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S13236 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13233 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13235 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); \<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13027 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13029 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q13234 final cap s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R13233 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> ?R13027 final cap s)))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S13236 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T13235 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T13029 final cap v)})})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap d v0 v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; is_final; v2 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; cp = arch_capability.PageCap d v0 v1 v2 v3\<rbrakk> \<Longrightarrow> \<exists>a b. v3 = Some (a, b)
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q13234 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S13236 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13233 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13235 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); \<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13027 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13029 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q13234 final cap s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R13233 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> ?R13027 final cap s)))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S13236 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T13235 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T13029 final cap v)})})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap d v0 v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; is_final; v2 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; cp = arch_capability.PageCap d v0 v1 v2 v3; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> \<exists>a b. v3 = Some (a, b)
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q13234 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S13236 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13233 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13235 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); \<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13027 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13029 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q13234 final cap s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R13233 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> ?R13027 final cap s)))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S13236 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T13235 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T13029 final cap v)})})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap d v0 v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; is_final; v2 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; cp = arch_capability.PageCap d v0 v1 v2 v3; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = 0) = ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = 0)\<rbrakk> \<Longrightarrow> \<exists>a b. v3 = Some (a, b)
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q13234 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S13236 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13233 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13235 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); \<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13027 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13029 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q13234 final cap s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R13233 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> ?R13027 final cap s)))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S13236 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T13235 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T13029 final cap v)})})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q13234 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S13236 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13233 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13235 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); \<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13027 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13029 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q13234 final cap s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R13233 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> ?R13027 final cap s)))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S13236 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T13235 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T13029 final cap v)})})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q13234 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S13236 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od) (\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13233 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13235 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); \<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13027 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13029 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q13234 final cap s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R13233 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> ?R13027 final cap s)))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S13236 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T13235 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T13029 final cap v)})})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q13234 (SCAST(32 signed \<rightarrow> 32) true) cap) (?S13236 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od) (\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFSize_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
(\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
(CALL unmapPage_'proc(\<acute>ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13233 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13235 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); \<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13027 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13029 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q13234 final cap s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R13233 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> ?R13027 final cap s)))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> ?S13236 final cap v va) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T13235 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T13029 final cap v)})})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap ret__unsigned. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b); ret__unsigned = capFSize_CL (cap_frame_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q13234 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'13271 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap)) ret__unsigned) [SKIP] (do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od) (\<acute>ret__unsigned_long :== CALL cap_frame_cap_get_capFMappedASID_'proc(cap);;
(\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
(\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
(CALL unmapPage_'proc(ret__unsigned,\<acute>ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13233 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13235 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); \<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13027 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13029 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q13234 final cap s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R13233 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> ?R13027 final cap s)))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> ?G'13271 final cap v va vb}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T13235 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T13029 final cap v)})})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap ret__unsigned ret__unsigned_long. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b); ret__unsigned = capFSize_CL (cap_frame_cap_lift cap); ret__unsigned_long = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q13234 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'13517 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap)) ret__unsigned ret__unsigned_long) [SKIP] (do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od) (\<acute>unsigned_eret_2 :== CALL cap_frame_cap_get_capFMappedAddress_'proc(cap);;
(\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
(CALL unmapPage_'proc(ret__unsigned,ret__unsigned_long,\<acute>unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13233 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13235 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); \<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13027 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13029 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q13234 final cap s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R13233 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> ?R13027 final cap s)))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := vc\<rparr> \<in> {s. s \<in> ?G'13517 final cap v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T13235 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T13029 final cap v)})})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap ret__unsigned ret__unsigned_long unsigned_eret_2. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b); ret__unsigned = capFSize_CL (cap_frame_cap_lift cap); ret__unsigned_long = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap); unsigned_eret_2 = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q13234 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'13726 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap)) ret__unsigned ret__unsigned_long unsigned_eret_2) [SKIP] (do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od) (\<acute>unsigned_eret_3 :== CALL cap_frame_cap_get_capFBasePtr_'proc(cap);;
(CALL unmapPage_'proc(ret__unsigned,ret__unsigned_long,unsigned_eret_2,PTR(unit) \<acute>unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13233 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13235 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); \<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13027 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13029 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q13234 final cap s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R13233 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> ?R13027 final cap s)))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>vd v'. vd = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vd\<rparr> \<in> {s. s \<in> ?G'13726 final cap v va vb vc vd}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T13235 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T13029 final cap v)})})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap ret__unsigned ret__unsigned_long unsigned_eret_2 unsigned_eret_3. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b); ret__unsigned = capFSize_CL (cap_frame_cap_lift cap); ret__unsigned_long = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap); unsigned_eret_2 = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap); unsigned_eret_3 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q13234 (SCAST(32 signed \<rightarrow> 32) true) cap) (?G'13910 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap)) ret__unsigned ret__unsigned_long unsigned_eret_2 unsigned_eret_3) [SKIP] (do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od) (CALL unmapPage_'proc(ret__unsigned,ret__unsigned_long,unsigned_eret_2,PTR(unit) unsigned_eret_3);;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13233 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13235 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); \<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13027 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13029 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?Q13234 final cap s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R13233 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> ?R13027 final cap s)))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>vd v'. vd = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vd\<rparr> \<in> {s. s \<in> {s. \<forall>ve v'. ve = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := ve\<rparr> \<in> {s. s \<in> ?G'13910 final cap v va vb vc vd ve}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T13235 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T13029 final cap v)})})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (6 subgoals):
 1. \<And>cap ret__unsigned ret__unsigned_long unsigned_eret_2 unsigned_eret_3 rv xfdc. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b); ret__unsigned = capFSize_CL (cap_frame_cap_lift cap); ret__unsigned_long = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap); unsigned_eret_2 = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap); unsigned_eret_3 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?Q14063 cap ret__unsigned ret__unsigned_long unsigned_eret_2 unsigned_eret_3 rv) (?Q'14063 cap ret__unsigned ret__unsigned_long unsigned_eret_2 unsigned_eret_3 rv xfdc) [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))
 2. \<And>cap ret__unsigned ret__unsigned_long unsigned_eret_2 unsigned_eret_3. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b); ret__unsigned = capFSize_CL (cap_frame_cap_lift cap); ret__unsigned_long = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap); unsigned_eret_2 = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap); unsigned_eret_3 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14072 (SCAST(32 signed \<rightarrow> 32) true) cap\<rbrace> unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp) \<lbrace>?Q14063 cap ret__unsigned ret__unsigned_long unsigned_eret_2 unsigned_eret_3\<rbrace>
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13233 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13235 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 5. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); \<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13027 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13029 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 6. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and ?R14072 final cap) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R13233 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> ?R13027 final cap s)))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>vd v'. vd = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vd\<rparr> \<in> {s. s \<in> {s. \<forall>ve v'. ve = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := ve\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) ve) (vptr_'_update (\<lambda>_. vd) (asid_'_update (\<lambda>_. vc) (page_size_'_update (\<lambda>_. vb) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'14069 final cap v va vb vc vd ve t rv}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T13235 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T13029 final cap v)})})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}}
flex-flex pairs:
\<lambda>cap. ?Q'14069 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap)) \<equiv>\<^sup>? \<lambda>cap ret__unsigned ret__unsigned_long unsigned_eret_2 unsigned_eret_3 t rv. ?Q'14063 cap ret__unsigned ret__unsigned_long unsigned_eret_2 unsigned_eret_3 rv (xfdc t) proof (prove)
goal (5 subgoals):
 1. \<And>cap ret__unsigned ret__unsigned_long unsigned_eret_2 unsigned_eret_3. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; \<exists>a b. capVPMappedAddress cp = Some (a, b); ret__unsigned = capFSize_CL (cap_frame_cap_lift cap); ret__unsigned_long = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap); unsigned_eret_2 = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap); unsigned_eret_3 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R14072 (SCAST(32 signed \<rightarrow> 32) true) cap\<rbrace> unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13233 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13235 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); \<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13027 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13029 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and ?R14072 final cap) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R13233 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> ?R13027 final cap s)))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T13235 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T13029 final cap v)})})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13233 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13235 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); \<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13027 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13029 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R13233 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> ?R13027 final cap s)))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T13235 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T13029 final cap v)})})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13233 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13235 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capVPMappedAddress cp = None
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); \<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13027 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13029 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R13233 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> ?R13027 final cap s)))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T13235 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T13029 final cap v)})})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capVPMappedAddress cp = None
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13233 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13235 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); \<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13027 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13029 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R13233 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> ?R13027 final cap s)))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T13235 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T13029 final cap v)})})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap d v0 v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; is_final; v2 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = 0; cp = arch_capability.PageCap d v0 v1 v2 v3\<rbrakk> \<Longrightarrow> v3 = None
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13233 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13235 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); \<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13027 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13029 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R13233 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> ?R13027 final cap s)))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T13235 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T13029 final cap v)})})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap d v0 v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; is_final; v2 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = 0; cp = arch_capability.PageCap d v0 v1 v2 v3; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> v3 = None
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13233 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13235 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); \<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13027 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13029 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R13233 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> ?R13027 final cap s)))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T13235 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T13029 final cap v)})})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (5 subgoals):
 1. \<And>cap d v0 v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; is_final; v2 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = 0; cp = arch_capability.PageCap d v0 v1 v2 v3; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = 0) = ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = 0)\<rbrakk> \<Longrightarrow> v3 = None
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13233 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13235 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 4. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); \<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13027 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13029 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 5. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R13233 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> ?R13027 final cap s)))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T13235 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T13029 final cap v)})})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; \<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13233 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13235 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap))) [SKIP] (if \<exists>a b. capVPMappedAddress cp = Some (a, b) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); \<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13027 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13029 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R13233 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> ?R13027 final cap s)))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T13235 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T13029 final cap v)})})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; isPageCap cp; capVPSize cp \<noteq> Wellformed_C.ARMSmallPage; \<not> isPageDirectoryCap cp; \<not> isASIDPoolCap cp; \<not> isPageTableCap cp; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = 0; capVPMappedAddress cp = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13233 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13235 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap) 0) [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 3. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); \<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13027 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13029 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 4. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> ?R13233 final cap s)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> ?R13027 final cap s)))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. (va \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> va \<noteq> 0 \<longrightarrow> s \<in> ?T13235 final cap v va)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T13029 final cap v)})})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (3 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> isPageCap cp \<longrightarrow> \<not> isPageDirectoryCap cp \<and> \<not> isASIDPoolCap cp \<and> \<not> isPageTableCap cp
 2. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); \<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13027 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13029 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 3. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> ?R13027 final cap s)))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T13029 final cap v)})})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (2 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage); \<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13027 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13029 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (if isPageTableCap cp \<and> (\<exists>a b. capPTMappedAddress cp = Some (a, b)) then do y <- unmapPageTable (fst (the (capPTMappedAddress cp))) (snd (the (capPTMappedAddress cp))) (capPTBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else if isPageCap cp \<and> (\<exists>a b. capVPMappedAddress cp = Some (a, b)) then do y <- unmapPage (capVPSize cp) (fst (the (capVPMappedAddress cp))) (snd (the (capVPMappedAddress cp))) (capVPBasePtr cp);
return (capability.NullCap, capability.NullCap)
od else return (capability.NullCap, capability.NullCap)) (SKIP;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_')))))
 2. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> ?R13027 final cap s)))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T13029 final cap v)})})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (2 subgoals):
 1. \<And>cap. \<lbrakk>ccap_relation (capability.ArchObjectCap cp) cap; is_final; \<not> isASIDPoolCap cp; \<not> isPageDirectoryCap cp; \<not> isPageTableCap cp; \<not> isPageCap cp\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. ccap_relation (fst a) (remainder_C b) \<and> ccap_relation (snd a) (finaliseCap_ret_C.cleanupInfo_C b)) ret__struct_finaliseCap_ret_C_' (?R13027 (SCAST(32 signed \<rightarrow> 32) true) cap) (?T13029 (SCAST(32 signed \<rightarrow> 32) true) cap (cap_get_tag cap)) [SKIP] (return (capability.NullCap, capability.NullCap)) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== remainder_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
(\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
(\<acute>fc_ret :== finaliseCap_ret_C.cleanupInfo_C_update (\<lambda>_. \<acute>ret__struct_cap_C) \<acute>fc_ret;;
return_C ret__struct_finaliseCap_ret_C_'_update fc_ret_'))))
 2. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> ?R13027 final cap s)))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> ?T13029 final cap v)})})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (1 subgoal):
 1. \<And>final cap s s'. \<lbrakk>final = from_bool is_final; ccap_relation (capability.ArchObjectCap cp) cap; (s, s') \<in> rf_sr; (invs' and valid_cap' (capability.ArchObjectCap cp) and (\<lambda>s. 2 ^ acapBits cp \<le> gsMaxObjectSize s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((is_final \<longrightarrow> (isASIDPoolCap cp \<longrightarrow> (invs' and (\<lambda>_. capASIDBase cp < 2 ^ 17 \<and> capASIDPool cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> (isPageDirectoryCap cp \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and K (the (capPDMappedASID cp) < 2 ^ 17) and K (capPDBasePtr cp \<noteq> 0) and (\<lambda>a. True)) s) \<and> (\<not> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> (isPageTableCap cp \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. fst (the (capPTMappedAddress cp)) \<le> mask local.asid_bits \<and> snd (the (capPTMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> isPageTableCap cp \<longrightarrow> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> True)))))) \<and> (\<not> is_final \<longrightarrow> (isPageCap cp \<longrightarrow> (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize Wellformed_C.ARMSmallPage \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) Wellformed_C.ARMSmallPage \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cp) \<le> gsMaxObjectSize s) and (\<lambda>_. fst (the (capVPMappedAddress cp)) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the (capVPMappedAddress cp))) (capVPSize cp) \<and> snd (the (capVPMappedAddress cp)) < pptrBase) and (\<lambda>a. True)) s) \<and> (\<not> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> True)) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ?R6806 final cap s))) \<and> (\<not> isPageCap cp \<longrightarrow> True))) \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. is_final \<longrightarrow> s \<in> {s. (isASIDPoolCap cp \<longrightarrow> s \<in> {s. \<forall>v v'. v = capASIDBase_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capASIDPool_CL (cap_asid_pool_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pool_'_update (\<lambda>_. ap_Ptr va) (asid_base_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid_base = capASIDBase cp\<rbrace> \<inter> \<lbrace>\<acute>pool = ap_Ptr (capASIDPool cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap}) \<and> (\<not> isASIDPoolCap cp \<longrightarrow> s \<in> {s. (isPageDirectoryCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPDIsMapped_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPDMappedASID_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPDBasePtr_CL (cap_page_directory_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. pd_'_update (\<lambda>_. pde_Ptr va) (asid_'_update (\<lambda>_. v) s) \<in> UNIV \<inter> \<lbrace>\<acute>asid = the (capPDMappedASID cp)\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr (capPDBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap}}) \<and> (\<not> isPageDirectoryCap cp \<longrightarrow> s \<in> {s. (isPageTableCap cp \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := 1\<rparr> \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr vb) (vaddr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = fst (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vaddr = snd (the (capPTMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}) \<and> (\<not> isPageTableCap cp \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp = Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> {s. (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> (isPageCap cp \<and> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage) \<longrightarrow> s \<in> UNIV)})})})})}} \<inter> {s. \<not> is_final \<longrightarrow> s \<in> {s. isPageCap cp \<longrightarrow> s \<in> {s. (capVPSize cp = Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vb) (vptr_'_update (\<lambda>_. va) (asid_'_update (\<lambda>_. v) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = Wellformed_C.ARMSmallPage \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap}) \<and> (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. (capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> {s. \<forall>v v'. v = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capFSize_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift (cap_' (cap_'_update (\<lambda>_. cap) s))) \<longrightarrow> s\<lparr>unsigned_eret_3_' := vc\<rparr> \<in> {s. s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cp \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = fst (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>vptr = snd (the (capVPMappedAddress cp))\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cp)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}) \<and> (\<not> capVPSize cp \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> s \<in> ?T6808 final cap v)})}} \<inter> {s. \<not> isPageCap cp \<longrightarrow> s \<in> UNIV}}} proof (prove)
goal (4 subgoals):
 1. \<And>cap s s' x11 x12. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11 x12)) cap; (s, s') \<in> rf_sr; cp = arch_capability.ASIDPoolCap x11 x12; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11 x12)) s; 4 * 2 ^ local.asid_low_bits \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> x12 < 0x20000 \<and> x11 \<noteq> 0) \<and> (is_final \<longrightarrow> capASIDBase_CL (cap_asid_pool_cap_lift cap) = x12 \<and> capASIDPool_CL (cap_asid_pool_cap_lift cap) = x11 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap)
 2. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (x34 = Wellformed_C.ARMSmallPage \<longrightarrow> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> 4096 \<le> gsMaxObjectSize s \<and> fst (the x35) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the x35)) Wellformed_C.ARMSmallPage \<and> snd (the x35) < pptrBase) \<and> (x34 \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x35) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the x35)) x34 \<and> snd (the x35) < pptrBase) \<and> (x34 = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) = Wellformed_C.ARMSmallPage \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4 \<and> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = fst (the x35) \<and> cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap) = snd (the x35) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) \<and> (x34 \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34 \<and> capFSize_CL (cap_frame_cap_lift cap) < 4 \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = fst (the x35) \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = snd (the x35) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap)
 3. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 4. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (4 subgoals):
 1. \<And>cap s s' x11 x12. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11 x12)) cap; (s, s') \<in> rf_sr; cp = arch_capability.ASIDPoolCap x11 x12; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11 x12)) s; 4 * 2 ^ local.asid_low_bits \<le> gsMaxObjectSize s; is_final\<rbrakk> \<Longrightarrow> x12 < 0x20000 \<and> x11 \<noteq> 0 \<and> capASIDBase_CL (cap_asid_pool_cap_lift cap) = x12 \<and> capASIDPool_CL (cap_asid_pool_cap_lift cap) = x11 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap
 2. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (x34 = Wellformed_C.ARMSmallPage \<longrightarrow> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> 4096 \<le> gsMaxObjectSize s \<and> fst (the x35) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the x35)) Wellformed_C.ARMSmallPage \<and> snd (the x35) < pptrBase) \<and> (x34 \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x35) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the x35)) x34 \<and> snd (the x35) < pptrBase) \<and> (x34 = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) = Wellformed_C.ARMSmallPage \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4 \<and> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = fst (the x35) \<and> cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap) = snd (the x35) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) \<and> (x34 \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34 \<and> capFSize_CL (cap_frame_cap_lift cap) < 4 \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = fst (the x35) \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = snd (the x35) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap)
 3. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 4. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (4 subgoals):
 1. \<And>cap s s' x11 x12. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11 x12)) cap; (s, s') \<in> rf_sr; cp = arch_capability.ASIDPoolCap x11 x12; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11 x12)) s; 4 * 2 ^ local.asid_low_bits \<le> gsMaxObjectSize s; is_final; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap\<rbrakk> \<Longrightarrow> x12 < 0x20000 \<and> x11 \<noteq> 0 \<and> capASIDBase_CL (cap_asid_pool_cap_lift cap) = x12 \<and> capASIDPool_CL (cap_asid_pool_cap_lift cap) = x11 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap
 2. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (x34 = Wellformed_C.ARMSmallPage \<longrightarrow> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> 4096 \<le> gsMaxObjectSize s \<and> fst (the x35) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the x35)) Wellformed_C.ARMSmallPage \<and> snd (the x35) < pptrBase) \<and> (x34 \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x35) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the x35)) x34 \<and> snd (the x35) < pptrBase) \<and> (x34 = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) = Wellformed_C.ARMSmallPage \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4 \<and> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = fst (the x35) \<and> cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap) = snd (the x35) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) \<and> (x34 \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34 \<and> capFSize_CL (cap_frame_cap_lift cap) < 4 \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = fst (the x35) \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = snd (the x35) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap)
 3. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 4. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (4 subgoals):
 1. \<And>cap s s' x11 x12. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11 x12)) cap; (s, s') \<in> rf_sr; cp = arch_capability.ASIDPoolCap x11 x12; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11 x12)) s; 4 * 2 ^ local.asid_low_bits \<le> gsMaxObjectSize s; is_final; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap; cap_lift cap = Some (Cap_asid_pool_cap \<lparr>capASIDBase_CL = (cap_C.words_C cap.[1] >> 0) && mask 17, capASIDPool_CL = (cap_C.words_C cap.[0] << 0) && ~~ mask 4\<rparr>)\<rbrakk> \<Longrightarrow> x12 < 0x20000 \<and> x11 \<noteq> 0 \<and> capASIDBase_CL (cap_asid_pool_cap_lift cap) = x12 \<and> capASIDPool_CL (cap_asid_pool_cap_lift cap) = x11 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap
 2. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (x34 = Wellformed_C.ARMSmallPage \<longrightarrow> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> 4096 \<le> gsMaxObjectSize s \<and> fst (the x35) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the x35)) Wellformed_C.ARMSmallPage \<and> snd (the x35) < pptrBase) \<and> (x34 \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x35) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the x35)) x34 \<and> snd (the x35) < pptrBase) \<and> (x34 = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) = Wellformed_C.ARMSmallPage \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4 \<and> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = fst (the x35) \<and> cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap) = snd (the x35) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) \<and> (x34 \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34 \<and> capFSize_CL (cap_frame_cap_lift cap) < 4 \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = fst (the x35) \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = snd (the x35) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap)
 3. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 4. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (4 subgoals):
 1. \<And>cap s s' x11 x12. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11 x12)) cap; (s, s') \<in> rf_sr; cp = arch_capability.ASIDPoolCap x11 x12; invs' s; 4 * 2 ^ local.asid_low_bits \<le> gsMaxObjectSize s; is_final; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap; cap_lift cap = Some (Cap_asid_pool_cap \<lparr>capASIDBase_CL = cap_C.words_C cap.[Suc 0] && mask 17, capASIDPool_CL = cap_C.words_C cap.[0] && ~~ mask 4\<rparr>); capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11 x12)); asid_pool_at' x11 s; is_aligned x12 local.asid_low_bits; x12 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> x12 < 0x20000 \<and> x11 \<noteq> 0 \<and> capASIDBase_CL (cap_asid_pool_cap_lift cap) = x12 \<and> capASIDPool_CL (cap_asid_pool_cap_lift cap) = x11
 2. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (x34 = Wellformed_C.ARMSmallPage \<longrightarrow> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> 4096 \<le> gsMaxObjectSize s \<and> fst (the x35) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the x35)) Wellformed_C.ARMSmallPage \<and> snd (the x35) < pptrBase) \<and> (x34 \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x35) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the x35)) x34 \<and> snd (the x35) < pptrBase) \<and> (x34 = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) = Wellformed_C.ARMSmallPage \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4 \<and> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = fst (the x35) \<and> cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap) = snd (the x35) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) \<and> (x34 \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34 \<and> capFSize_CL (cap_frame_cap_lift cap) < 4 \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = fst (the x35) \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = snd (the x35) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap)
 3. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 4. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (3 subgoals):
 1. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (x34 = Wellformed_C.ARMSmallPage \<longrightarrow> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> 4096 \<le> gsMaxObjectSize s \<and> fst (the x35) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the x35)) Wellformed_C.ARMSmallPage \<and> snd (the x35) < pptrBase) \<and> (x34 \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x35) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the x35)) x34 \<and> snd (the x35) < pptrBase) \<and> (x34 = Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) = Wellformed_C.ARMSmallPage \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4 \<and> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = fst (the x35) \<and> cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap) = snd (the x35) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) \<and> (x34 \<noteq> Wellformed_C.ARMSmallPage \<longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34 \<and> capFSize_CL (cap_frame_cap_lift cap) < 4 \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = fst (the x35) \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = snd (the x35) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap)
 2. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 3. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (6 subgoals):
 1. \<And>cap s s' x31 x32 x33 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) s; 4096 \<le> gsMaxObjectSize s; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> fst (the x35) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the x35)) Wellformed_C.ARMSmallPage \<and> snd (the x35) < pptrBase
 2. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> fst (the x35) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the x35)) x34 \<and> snd (the x35) < pptrBase
 3. \<And>cap s s' x31 x32 x33 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) s; 4096 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) = Wellformed_C.ARMSmallPage \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4 \<and> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = fst (the x35) \<and> cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap) = snd (the x35) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 4. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34 \<and> capFSize_CL (cap_frame_cap_lift cap) < 4 \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = fst (the x35) \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = snd (the x35) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 5. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 6. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (7 subgoals):
 1. \<And>cap s s' x31 x32 x33 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) s; 4096 \<le> gsMaxObjectSize s; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> fst (the x35) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the x35)) Wellformed_C.ARMSmallPage \<and> snd (the x35) < pptrBase
 2. \<And>cap s s' x31 x32 x33 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) s; 4096 \<le> gsMaxObjectSize s; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capVPMappedAddress cp \<noteq> None
 3. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> fst (the x35) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the x35)) x34 \<and> snd (the x35) < pptrBase
 4. \<And>cap s s' x31 x32 x33 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) s; 4096 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) = Wellformed_C.ARMSmallPage \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4 \<and> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = fst (the x35) \<and> cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap) = snd (the x35) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 5. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34 \<and> capFSize_CL (cap_frame_cap_lift cap) < 4 \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = fst (the x35) \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = snd (the x35) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 6. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 7. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (6 subgoals):
 1. \<And>cap s s' x31 x32 x33 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) s; 4096 \<le> gsMaxObjectSize s; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capVPMappedAddress cp \<noteq> None
 2. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> fst (the x35) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the x35)) x34 \<and> snd (the x35) < pptrBase
 3. \<And>cap s s' x31 x32 x33 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) s; 4096 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) = Wellformed_C.ARMSmallPage \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4 \<and> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = fst (the x35) \<and> cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap) = snd (the x35) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 4. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34 \<and> capFSize_CL (cap_frame_cap_lift cap) < 4 \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = fst (the x35) \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = snd (the x35) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 5. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 6. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (6 subgoals):
 1. \<And>cap s s' x31 x32 x33 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) s; 4096 \<le> gsMaxObjectSize s; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> capVPMappedAddress cp \<noteq> None
 2. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> fst (the x35) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the x35)) x34 \<and> snd (the x35) < pptrBase
 3. \<And>cap s s' x31 x32 x33 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) s; 4096 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) = Wellformed_C.ARMSmallPage \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4 \<and> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = fst (the x35) \<and> cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap) = snd (the x35) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 4. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34 \<and> capFSize_CL (cap_frame_cap_lift cap) < 4 \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = fst (the x35) \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = snd (the x35) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 5. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 6. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (6 subgoals):
 1. \<And>cap s s' x31 x32 x33 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) s; 4096 \<le> gsMaxObjectSize s; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = 0) = ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = 0)\<rbrakk> \<Longrightarrow> capVPMappedAddress cp \<noteq> None
 2. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> fst (the x35) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the x35)) x34 \<and> snd (the x35) < pptrBase
 3. \<And>cap s s' x31 x32 x33 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) s; 4096 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) = Wellformed_C.ARMSmallPage \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4 \<and> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = fst (the x35) \<and> cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap) = snd (the x35) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 4. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34 \<and> capFSize_CL (cap_frame_cap_lift cap) < 4 \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = fst (the x35) \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = snd (the x35) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 5. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 6. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (5 subgoals):
 1. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> fst (the x35) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the x35)) x34 \<and> snd (the x35) < pptrBase
 2. \<And>cap s s' x31 x32 x33 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) s; 4096 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) = Wellformed_C.ARMSmallPage \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4 \<and> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = fst (the x35) \<and> cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap) = snd (the x35) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 3. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34 \<and> capFSize_CL (cap_frame_cap_lift cap) < 4 \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = fst (the x35) \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = snd (the x35) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 4. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 5. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (6 subgoals):
 1. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> fst (the x35) \<le> mask local.asid_bits \<and> vmsz_aligned' (snd (the x35)) x34 \<and> snd (the x35) < pptrBase
 2. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capVPMappedAddress cp \<noteq> None
 3. \<And>cap s s' x31 x32 x33 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) s; 4096 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) = Wellformed_C.ARMSmallPage \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4 \<and> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = fst (the x35) \<and> cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap) = snd (the x35) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 4. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34 \<and> capFSize_CL (cap_frame_cap_lift cap) < 4 \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = fst (the x35) \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = snd (the x35) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 5. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 6. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (5 subgoals):
 1. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capVPMappedAddress cp \<noteq> None
 2. \<And>cap s s' x31 x32 x33 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) s; 4096 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) = Wellformed_C.ARMSmallPage \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4 \<and> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = fst (the x35) \<and> cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap) = snd (the x35) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 3. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34 \<and> capFSize_CL (cap_frame_cap_lift cap) < 4 \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = fst (the x35) \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = snd (the x35) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 4. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 5. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (5 subgoals):
 1. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> \<exists>a b. x35 = Some (a, b)
 2. \<And>cap s s' x31 x32 x33 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) s; 4096 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) = Wellformed_C.ARMSmallPage \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4 \<and> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = fst (the x35) \<and> cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap) = snd (the x35) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 3. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34 \<and> capFSize_CL (cap_frame_cap_lift cap) < 4 \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = fst (the x35) \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = snd (the x35) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 4. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 5. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (5 subgoals):
 1. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = 0) = ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = 0)\<rbrakk> \<Longrightarrow> \<exists>a b. x35 = Some (a, b)
 2. \<And>cap s s' x31 x32 x33 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) s; 4096 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) = Wellformed_C.ARMSmallPage \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4 \<and> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = fst (the x35) \<and> cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap) = snd (the x35) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 3. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34 \<and> capFSize_CL (cap_frame_cap_lift cap) < 4 \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = fst (the x35) \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = snd (the x35) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 4. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 5. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (4 subgoals):
 1. \<And>cap s s' x31 x32 x33 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) s; 4096 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) = Wellformed_C.ARMSmallPage \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4 \<and> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = fst (the x35) \<and> cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap) = snd (the x35) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 2. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34 \<and> capFSize_CL (cap_frame_cap_lift cap) < 4 \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = fst (the x35) \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = snd (the x35) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 3. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 4. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (5 subgoals):
 1. \<And>cap s s' x31 x32 x33 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) s; 4096 \<le> gsMaxObjectSize s; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) = Wellformed_C.ARMSmallPage \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4 \<and> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = fst (the x35) \<and> cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap) = snd (the x35) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 2. \<And>cap s s' x31 x32 x33 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) s; 4096 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 3. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34 \<and> capFSize_CL (cap_frame_cap_lift cap) < 4 \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = fst (the x35) \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = snd (the x35) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 4. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 5. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (5 subgoals):
 1. \<And>cap s s' x31 x32 x33 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) s; 4096 \<le> gsMaxObjectSize s; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) = Wellformed_C.ARMSmallPage \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4 \<and> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = fst (the x35) \<and> cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap) = snd (the x35) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 2. \<And>cap s s' x31 x32 x33 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) s; 4096 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 3. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34 \<and> capFSize_CL (cap_frame_cap_lift cap) < 4 \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = fst (the x35) \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = snd (the x35) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 4. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 5. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (5 subgoals):
 1. \<And>cap s s' x31 x32 x33 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) s; 4096 \<le> gsMaxObjectSize s; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = 0) = ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = 0)\<rbrakk> \<Longrightarrow> gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) = Wellformed_C.ARMSmallPage \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4 \<and> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = fst (the x35) \<and> cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap) = snd (the x35) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 2. \<And>cap s s' x31 x32 x33 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) s; 4096 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 3. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34 \<and> capFSize_CL (cap_frame_cap_lift cap) < 4 \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = fst (the x35) \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = snd (the x35) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 4. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 5. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (6 subgoals):
 1. \<And>cap s s' x31 x32 x33 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) s; 4096 \<le> gsMaxObjectSize s; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = 0) = ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = 0); capVPMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) = Wellformed_C.ARMSmallPage \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage < 4 \<and> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = fst (the x35) \<and> cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap) = snd (the x35) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 2. \<And>cap s s' x31 x32 x33 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) s; 4096 \<le> gsMaxObjectSize s; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = 0) = ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = 0)\<rbrakk> \<Longrightarrow> capVPMappedAddress cp \<noteq> None
 3. \<And>cap s s' x31 x32 x33 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) s; 4096 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 4. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34 \<and> capFSize_CL (cap_frame_cap_lift cap) < 4 \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = fst (the x35) \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = snd (the x35) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 5. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 6. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (5 subgoals):
 1. \<And>cap s s' x31 x32 x33 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) s; 4096 \<le> gsMaxObjectSize s; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = 0) = ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asidLowBits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = 0)\<rbrakk> \<Longrightarrow> capVPMappedAddress cp \<noteq> None
 2. \<And>cap s s' x31 x32 x33 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) s; 4096 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 3. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34 \<and> capFSize_CL (cap_frame_cap_lift cap) < 4 \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = fst (the x35) \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = snd (the x35) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 4. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 5. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (4 subgoals):
 1. \<And>cap s s' x31 x32 x33 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 Wellformed_C.ARMSmallPage x35)) s; 4096 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap
 2. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34 \<and> capFSize_CL (cap_frame_cap_lift cap) < 4 \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = fst (the x35) \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = snd (the x35) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 3. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 4. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (3 subgoals):
 1. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0 \<longrightarrow> gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34 \<and> capFSize_CL (cap_frame_cap_lift cap) < 4 \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = fst (the x35) \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = snd (the x35) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 2. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 3. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (4 subgoals):
 1. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34 \<and> capFSize_CL (cap_frame_cap_lift cap) < 4 \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = fst (the x35) \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = snd (the x35) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 2. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 3. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 4. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (5 subgoals):
 1. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; capVPMappedAddress cp \<noteq> None\<rbrakk> \<Longrightarrow> gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34 \<and> capFSize_CL (cap_frame_cap_lift cap) < 4 \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = fst (the x35) \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = snd (the x35) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 2. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capVPMappedAddress cp \<noteq> None
 3. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 4. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 5. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (5 subgoals):
 1. \<And>cap s s' x31 x32 x33 x34 a b. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)))) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)); invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)))) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34 \<and> capFSize_CL (cap_frame_cap_lift cap) < 4 \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = a \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = b \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 2. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capVPMappedAddress cp \<noteq> None
 3. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 4. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 5. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (5 subgoals):
 1. \<And>cap s s' x31 x32 x33 x34 a b. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)))) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)); invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)))) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34 \<and> capFSize_CL (cap_frame_cap_lift cap) < 4 \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = a \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = b \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 2. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capVPMappedAddress cp \<noteq> None
 3. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 4. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 5. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (5 subgoals):
 1. \<And>cap s s' x31 x32 x33 x34 a b. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)))) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)); invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)))) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = 0) = ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = 0)\<rbrakk> \<Longrightarrow> gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34 \<and> capFSize_CL (cap_frame_cap_lift cap) < 4 \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = a \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = b \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 2. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capVPMappedAddress cp \<noteq> None
 3. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 4. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 5. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (5 subgoals):
 1. \<And>cap s s' x31 x32 x33 x34 a b. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)))) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)); invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)))) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = 0) = ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = 0); gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34\<rbrakk> \<Longrightarrow> gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34 \<and> capFSize_CL (cap_frame_cap_lift cap) < 4 \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = a \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = b \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 2. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capVPMappedAddress cp \<noteq> None
 3. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 4. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 5. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (5 subgoals):
 1. \<And>cap s s' x31 x32 x33 x34 a b. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)))) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)); invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)))) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) = 0 \<longrightarrow> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34\<rbrakk> \<Longrightarrow> capFSize_CL (cap_frame_cap_lift cap) < 4 \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = a \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = b \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32
 2. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capVPMappedAddress cp \<noteq> None
 3. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 4. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 5. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (6 subgoals):
 1. \<And>cap s s' x31 x32 x33 x34 a b. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)))) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)); invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)))) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) = 0 \<longrightarrow> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34\<rbrakk> \<Longrightarrow> capFSize_CL (cap_frame_cap_lift cap) < 4
 2. \<And>cap s s' x31 x32 x33 x34 a b. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)))) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)); invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)))) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) = 0 \<longrightarrow> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34\<rbrakk> \<Longrightarrow> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = a \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = b \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32
 3. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capVPMappedAddress cp \<noteq> None
 4. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 5. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 6. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (6 subgoals):
 1. \<And>cap s s' x31 x32 x33 x34 a b. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)))) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)); invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)))) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) = 0 \<longrightarrow> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> capFSize_CL (cap_frame_cap_lift cap) < 4
 2. \<And>cap s s' x31 x32 x33 x34 a b. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)))) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)); invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)))) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) = 0 \<longrightarrow> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34\<rbrakk> \<Longrightarrow> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = a \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = b \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32
 3. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capVPMappedAddress cp \<noteq> None
 4. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 5. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 6. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (6 subgoals):
 1. \<And>cap s s' x31 x32 x33 x34 a b. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)))) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)); invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)))) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) = 0 \<longrightarrow> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; capFSize_CL (cap_frame_cap_lift cap) \<le> 3\<rbrakk> \<Longrightarrow> capFSize_CL (cap_frame_cap_lift cap) < 4
 2. \<And>cap s s' x31 x32 x33 x34 a b. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)))) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)); invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)))) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) = 0 \<longrightarrow> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34\<rbrakk> \<Longrightarrow> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = a \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = b \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32
 3. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capVPMappedAddress cp \<noteq> None
 4. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 5. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 6. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (5 subgoals):
 1. \<And>cap s s' x31 x32 x33 x34 a b. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)))) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)); invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 (Some (a, b)))) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) = 0 \<longrightarrow> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) = x34\<rbrakk> \<Longrightarrow> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = a \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = b \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32
 2. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capVPMappedAddress cp \<noteq> None
 3. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 4. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 5. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (5 subgoals):
 1. \<And>cap s s' x31 x32 x33 a b. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap))) (Some (a, b)))) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap))) (Some (a, b)); invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap))) (Some (a, b)))) s; 2 ^ pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap))) \<le> gsMaxObjectSize s; gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) = 0 \<longrightarrow> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = a \<and> cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) = b \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) = x32
 2. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capVPMappedAddress cp \<noteq> None
 3. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 4. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 5. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (4 subgoals):
 1. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capVPMappedAddress cp \<noteq> None
 2. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 3. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 4. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (4 subgoals):
 1. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> capVPMappedAddress cp \<noteq> None
 2. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 3. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 4. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (4 subgoals):
 1. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = 0) = ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asidLowBits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = 0)\<rbrakk> \<Longrightarrow> capVPMappedAddress cp \<noteq> None
 2. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 3. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 4. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (3 subgoals):
 1. \<And>cap s s' x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageCap x31 x32 x33 x34 x35; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; 2 ^ pageBitsForSize x34 \<le> gsMaxObjectSize s; x34 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap
 2. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 3. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (2 subgoals):
 1. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (is_final \<longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap)
 2. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (2 subgoals):
 1. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s; is_final\<rbrakk> \<Longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase) \<and> (capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap
 2. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (4 subgoals):
 1. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s; is_final; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase
 2. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s; is_final; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap
 3. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s; is_final\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap
 4. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (4 subgoals):
 1. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s; is_final; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap\<rbrakk> \<Longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase
 2. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s; is_final; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap
 3. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s; is_final\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap
 4. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (4 subgoals):
 1. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s; is_final; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; cap_lift cap = Some (Cap_page_table_cap \<lparr>capPTIsMapped_CL = (cap_C.words_C cap.[1] >> 29) && mask 1, capPTMappedASID_CL = (cap_C.words_C cap.[1] >> 12) && mask 17, capPTMappedAddress_CL = (cap_C.words_C cap.[1] << 20) && ~~ mask 20, capPTBasePtr_CL = (cap_C.words_C cap.[0] << 0) && ~~ mask 10\<rparr>)\<rbrakk> \<Longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase
 2. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s; is_final; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap
 3. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s; is_final\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap
 4. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (5 subgoals):
 1. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s; is_final; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; cap_lift cap = Some (Cap_page_table_cap \<lparr>capPTIsMapped_CL = (cap_C.words_C cap.[1] >> 29) && mask 1, capPTMappedASID_CL = (cap_C.words_C cap.[1] >> 12) && mask 17, capPTMappedAddress_CL = (cap_C.words_C cap.[1] << 20) && ~~ mask 20, capPTBasePtr_CL = (cap_C.words_C cap.[0] << 0) && ~~ mask 10\<rparr>); x42 \<noteq> None\<rbrakk> \<Longrightarrow> fst (the x42) \<le> mask local.asid_bits \<and> snd (the x42) < pptrBase
 2. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s; is_final; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; cap_lift cap = Some (Cap_page_table_cap \<lparr>capPTIsMapped_CL = (cap_C.words_C cap.[1] >> 29) && mask 1, capPTMappedASID_CL = (cap_C.words_C cap.[1] >> 12) && mask 17, capPTMappedAddress_CL = (cap_C.words_C cap.[1] << 20) && ~~ mask 20, capPTBasePtr_CL = (cap_C.words_C cap.[0] << 0) && ~~ mask 10\<rparr>)\<rbrakk> \<Longrightarrow> x42 \<noteq> None
 3. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s; is_final; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap
 4. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s; is_final\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap
 5. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (4 subgoals):
 1. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s; is_final; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; cap_lift cap = Some (Cap_page_table_cap \<lparr>capPTIsMapped_CL = (cap_C.words_C cap.[1] >> 29) && mask 1, capPTMappedASID_CL = (cap_C.words_C cap.[1] >> 12) && mask 17, capPTMappedAddress_CL = (cap_C.words_C cap.[1] << 20) && ~~ mask 20, capPTBasePtr_CL = (cap_C.words_C cap.[0] << 0) && ~~ mask 10\<rparr>)\<rbrakk> \<Longrightarrow> x42 \<noteq> None
 2. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s; is_final; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap
 3. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s; is_final\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap
 4. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (3 subgoals):
 1. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s; is_final; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap
 2. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s; is_final\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap
 3. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (3 subgoals):
 1. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s; is_final; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap\<rbrakk> \<Longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap
 2. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s; is_final\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap
 3. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (3 subgoals):
 1. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s; is_final; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; cap_lift cap = Some (Cap_page_table_cap \<lparr>capPTIsMapped_CL = (cap_C.words_C cap.[1] >> 29) && mask 1, capPTMappedASID_CL = (cap_C.words_C cap.[1] >> 12) && mask 17, capPTMappedAddress_CL = (cap_C.words_C cap.[1] << 20) && ~~ mask 20, capPTBasePtr_CL = (cap_C.words_C cap.[0] << 0) && ~~ mask 10\<rparr>)\<rbrakk> \<Longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap
 2. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s; is_final\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap
 3. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (4 subgoals):
 1. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s; is_final; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; cap_lift cap = Some (Cap_page_table_cap \<lparr>capPTIsMapped_CL = (cap_C.words_C cap.[1] >> 29) && mask 1, capPTMappedASID_CL = (cap_C.words_C cap.[1] >> 12) && mask 17, capPTMappedAddress_CL = (cap_C.words_C cap.[1] << 20) && ~~ mask 20, capPTBasePtr_CL = (cap_C.words_C cap.[0] << 0) && ~~ mask 10\<rparr>); x42 \<noteq> None\<rbrakk> \<Longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift cap) = fst (the x42) \<and> capPTMappedAddress_CL (cap_page_table_cap_lift cap) = snd (the x42) \<and> capPTBasePtr_CL (cap_page_table_cap_lift cap) = x41 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap
 2. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s; is_final; capPTIsMapped_CL (cap_page_table_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; cap_lift cap = Some (Cap_page_table_cap \<lparr>capPTIsMapped_CL = (cap_C.words_C cap.[1] >> 29) && mask 1, capPTMappedASID_CL = (cap_C.words_C cap.[1] >> 12) && mask 17, capPTMappedAddress_CL = (cap_C.words_C cap.[1] << 20) && ~~ mask 20, capPTBasePtr_CL = (cap_C.words_C cap.[0] << 0) && ~~ mask 10\<rparr>)\<rbrakk> \<Longrightarrow> x42 \<noteq> None
 3. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s; is_final\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap
 4. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (2 subgoals):
 1. \<And>cap s s' x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageTableCap x41 x42; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) s; 1024 \<le> gsMaxObjectSize s; is_final\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap
 2. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (1 subgoal):
 1. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (is_final \<longrightarrow> capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (is_final \<longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) proof (prove)
goal (1 subgoal):
 1. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final\<rbrakk> \<Longrightarrow> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0) \<and> (capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0 \<longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap) \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap proof (prove)
goal (3 subgoals):
 1. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0
 2. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap
 3. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap proof (prove)
goal (4 subgoals):
 1. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0; x52 \<noteq> None\<rbrakk> \<Longrightarrow> the x52 < 0x20000 \<and> x51 \<noteq> 0
 2. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> x52 \<noteq> None
 3. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap
 4. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap proof (prove)
goal (4 subgoals):
 1. \<And>cap s s' x51 y. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 (Some y))) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 (Some y); invs' s; 16384 \<le> gsMaxObjectSize s; is_final; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0; capAligned (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 (Some y))); page_directory_at' x51 s; 0 < y; y < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> y < 0x20000 \<and> x51 \<noteq> 0
 2. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> x52 \<noteq> None
 3. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap
 4. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap proof (prove)
goal (3 subgoals):
 1. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> x52 \<noteq> None
 2. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap
 3. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap proof (prove)
goal (3 subgoals):
 1. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap\<rbrakk> \<Longrightarrow> x52 \<noteq> None
 2. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap
 3. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap proof (prove)
goal (3 subgoals):
 1. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; cap_lift cap = Some (Cap_page_directory_cap \<lparr>capPDMappedASID_CL = (cap_C.words_C cap.[1] >> 0) && mask 17, capPDIsMapped_CL = (cap_C.words_C cap.[0] >> 4) && mask 1, capPDBasePtr_CL = (cap_C.words_C cap.[0] << 0) && ~~ mask 14\<rparr>)\<rbrakk> \<Longrightarrow> x52 \<noteq> None
 2. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap
 3. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap proof (prove)
goal (2 subgoals):
 1. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap
 2. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap proof (prove)
goal (3 subgoals):
 1. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0; x52 \<noteq> None\<rbrakk> \<Longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap
 2. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> x52 \<noteq> None
 3. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap proof (prove)
goal (3 subgoals):
 1. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0; x52 \<noteq> None; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap\<rbrakk> \<Longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap
 2. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> x52 \<noteq> None
 3. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap proof (prove)
goal (3 subgoals):
 1. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0; x52 \<noteq> None; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; cap_lift cap = Some (Cap_page_directory_cap \<lparr>capPDMappedASID_CL = (cap_C.words_C cap.[1] >> 0) && mask 17, capPDIsMapped_CL = (cap_C.words_C cap.[0] >> 4) && mask 1, capPDBasePtr_CL = (cap_C.words_C cap.[0] << 0) && ~~ mask 14\<rparr>)\<rbrakk> \<Longrightarrow> capPDMappedASID_CL (cap_page_directory_cap_lift cap) = the x52 \<and> capPDBasePtr_CL (cap_page_directory_cap_lift cap) = x51 \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap
 2. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> x52 \<noteq> None
 3. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap proof (prove)
goal (2 subgoals):
 1. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0\<rbrakk> \<Longrightarrow> x52 \<noteq> None
 2. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap proof (prove)
goal (2 subgoals):
 1. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap\<rbrakk> \<Longrightarrow> x52 \<noteq> None
 2. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap proof (prove)
goal (2 subgoals):
 1. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final; capPDIsMapped_CL (cap_page_directory_cap_lift cap) \<noteq> 0; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; cap_lift cap = Some (Cap_page_directory_cap \<lparr>capPDMappedASID_CL = (cap_C.words_C cap.[1] >> 0) && mask 17, capPDIsMapped_CL = (cap_C.words_C cap.[0] >> 4) && mask 1, capPDBasePtr_CL = (cap_C.words_C cap.[0] << 0) && ~~ mask 14\<rparr>)\<rbrakk> \<Longrightarrow> x52 \<noteq> None
 2. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap proof (prove)
goal (1 subgoal):
 1. \<And>cap s s' x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap; (s, s') \<in> rf_sr; cp = arch_capability.PageDirectoryCap x51 x52; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) s; 16384 \<le> gsMaxObjectSize s; is_final\<rbrakk> \<Longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap proof (prove)
goal:
No subgoals!