theory ArchArch_IF

lemma set_asid_pool_delete_ev2:
  "equiv_valid_2 (reads_equiv aag) (affects_equiv aag l) (affects_equiv aag l) \<top>\<top>
     (\<lambda>s. arm_asid_table (arch_state s) (asid_high_bits_of asid) = Some a \<and>
          kheap s a = Some (ArchObj (ASIDPool pool)) \<and> asid \<noteq> 0 \<and> is_subject_asid aag asid)
     (\<lambda>s. arm_asid_table (arch_state s) (asid_high_bits_of asid) = Some a \<and>
          kheap s a = Some (ArchObj (ASIDPool pool')) \<and> asid \<noteq> 0 \<and> is_subject_asid aag asid)
     (set_asid_pool a (pool(ucast asid := None))) (set_asid_pool a (pool'(ucast asid := None)))" apply (clarsimp simp: equiv_valid_2_def) apply (frule_tac s'=b in set_asid_pool_state_equal_except_kheap) apply (frule_tac s'=ba in set_asid_pool_state_equal_except_kheap) apply (clarsimp simp: states_equal_except_kheap_asid_def) apply (rule conjI) apply (clarsimp simp: states_equiv_for_def reads_equiv_def equiv_for_def | rule conjI)+ apply (case_tac "x=a") apply (clarsimp) apply (fastforce) apply (clarsimp simp: equiv_asids_def equiv_asid_def | rule conjI)+ apply (case_tac "pool_ptr = a") apply (clarsimp) apply (erule_tac x="pasASIDAbs aag asid" in ballE) apply (clarsimp) apply (erule_tac x=asid in allE)+ apply (clarsimp) apply (drule aag_can_read_own_asids, simp) apply (erule_tac x="pasASIDAbs aag asida" in ballE) apply (clarsimp) apply (erule_tac x=asida in allE)+ apply (clarsimp) apply (clarsimp) apply (clarsimp) apply (case_tac "pool_ptr=a") apply (erule_tac x="pasASIDAbs aag asida" in ballE) apply (clarsimp)+ apply (clarsimp simp: affects_equiv_def equiv_for_def states_equiv_for_def | rule conjI)+ apply (case_tac "x=a") apply (clarsimp) apply (fastforce) apply (clarsimp simp: equiv_asids_def equiv_asid_def | rule conjI)+ apply (case_tac "pool_ptr=a") apply (clarsimp) apply (erule_tac x=asid in allE)+ apply (clarsimp simp: asid_pool_at_kheap) apply (erule_tac x=asida in allE)+ apply (clarsimp) apply (clarsimp) apply (case_tac "pool_ptr=a") apply (clarsimp)+ done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. equiv_valid_2 (reads_equiv aag) (affects_equiv aag l) (affects_equiv aag l) (\<lambda>_ _. True) (\<lambda>s. asid_table s (asid_high_bits_of asid) = Some a \<and> kheap s a = Some (ArchObj (ASIDPool pool)) \<and> asid \<noteq> 0 \<and> is_subject_asid aag asid) (\<lambda>s. asid_table s (asid_high_bits_of asid) = Some a \<and> kheap s a = Some (ArchObj (ASIDPool pool')) \<and> asid \<noteq> 0 \<and> is_subject_asid aag asid) (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None))) (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None))) proof (prove)
goal (1 subgoal):
 1. \<And>s t b ba. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table s (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table t (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; affects_equiv aag l s t\<rbrakk> \<Longrightarrow> reads_equiv aag b ba \<and> affects_equiv aag l b ba proof (prove)
goal (1 subgoal):
 1. \<And>s t b ba. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table s (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table t (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; affects_equiv aag l s t; states_equal_except_kheap_asid s b \<and> (\<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p) \<and> kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))) \<and> (\<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (\<forall>asid_pool asid_pool'. pool_ptr \<noteq> a \<longrightarrow> kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))))\<rbrakk> \<Longrightarrow> reads_equiv aag b ba \<and> affects_equiv aag l b ba proof (prove)
goal (1 subgoal):
 1. \<And>s t b ba. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table s (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table t (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; affects_equiv aag l s t; states_equal_except_kheap_asid s b \<and> (\<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p) \<and> kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))) \<and> (\<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (\<forall>asid_pool asid_pool'. pool_ptr \<noteq> a \<longrightarrow> kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); states_equal_except_kheap_asid t ba \<and> (\<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p) \<and> kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))) \<and> (\<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (\<forall>asid_pool asid_pool'. pool_ptr \<noteq> a \<longrightarrow> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))))\<rbrakk> \<Longrightarrow> reads_equiv aag b ba \<and> affects_equiv aag l b ba proof (prove)
goal (1 subgoal):
 1. \<And>s t b ba. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; affects_equiv aag l s t; equiv_for (\<lambda>x. True) underlying_memory (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) underlying_memory (machine_state t) (machine_state ba); equiv_for (\<lambda>x. True) device_state (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) device_state (machine_state t) (machine_state ba); equiv_for (\<lambda>_. True) cdt s b; equiv_for (\<lambda>_. True) cdt t ba; equiv_for (\<lambda>_. True) cdt_list s b; equiv_for (\<lambda>_. True) cdt_list t ba; equiv_for (\<lambda>_. True) ekheap s b; equiv_for (\<lambda>_. True) ekheap t ba; equiv_for (\<lambda>_. True) ready_queues s b; equiv_for (\<lambda>_. True) ready_queues t ba; equiv_for (\<lambda>_. True) is_original_cap s b; equiv_for (\<lambda>_. True) is_original_cap t ba; equiv_for (\<lambda>_. True) interrupt_states s b; equiv_for (\<lambda>_. True) interrupt_states t ba; equiv_for (\<lambda>_. True) interrupt_irq_node s b; equiv_for (\<lambda>_. True) interrupt_irq_node t ba; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))))\<rbrakk> \<Longrightarrow> reads_equiv aag b ba \<and> affects_equiv aag l b ba proof (prove)
goal (2 subgoals):
 1. \<And>s t b ba. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; affects_equiv aag l s t; equiv_for (\<lambda>x. True) underlying_memory (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) underlying_memory (machine_state t) (machine_state ba); equiv_for (\<lambda>x. True) device_state (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) device_state (machine_state t) (machine_state ba); equiv_for (\<lambda>_. True) cdt s b; equiv_for (\<lambda>_. True) cdt t ba; equiv_for (\<lambda>_. True) cdt_list s b; equiv_for (\<lambda>_. True) cdt_list t ba; equiv_for (\<lambda>_. True) ekheap s b; equiv_for (\<lambda>_. True) ekheap t ba; equiv_for (\<lambda>_. True) ready_queues s b; equiv_for (\<lambda>_. True) ready_queues t ba; equiv_for (\<lambda>_. True) is_original_cap s b; equiv_for (\<lambda>_. True) is_original_cap t ba; equiv_for (\<lambda>_. True) interrupt_states s b; equiv_for (\<lambda>_. True) interrupt_states t ba; equiv_for (\<lambda>_. True) interrupt_irq_node s b; equiv_for (\<lambda>_. True) interrupt_irq_node t ba; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))))\<rbrakk> \<Longrightarrow> reads_equiv aag b ba
 2. \<And>s t b ba. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; affects_equiv aag l s t; equiv_for (\<lambda>x. True) underlying_memory (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) underlying_memory (machine_state t) (machine_state ba); equiv_for (\<lambda>x. True) device_state (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) device_state (machine_state t) (machine_state ba); equiv_for (\<lambda>_. True) cdt s b; equiv_for (\<lambda>_. True) cdt t ba; equiv_for (\<lambda>_. True) cdt_list s b; equiv_for (\<lambda>_. True) cdt_list t ba; equiv_for (\<lambda>_. True) ekheap s b; equiv_for (\<lambda>_. True) ekheap t ba; equiv_for (\<lambda>_. True) ready_queues s b; equiv_for (\<lambda>_. True) ready_queues t ba; equiv_for (\<lambda>_. True) is_original_cap s b; equiv_for (\<lambda>_. True) is_original_cap t ba; equiv_for (\<lambda>_. True) interrupt_states s b; equiv_for (\<lambda>_. True) interrupt_states t ba; equiv_for (\<lambda>_. True) interrupt_irq_node s b; equiv_for (\<lambda>_. True) interrupt_irq_node t ba; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))))\<rbrakk> \<Longrightarrow> affects_equiv aag l b ba proof (prove)
goal (3 subgoals):
 1. \<And>s t b ba x. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read aag x; \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> equiv_asids (\<lambda>x. d = pasASIDAbs aag x) s t; cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba)\<rbrakk> \<Longrightarrow> kheap b x = kheap ba x
 2. \<And>s t b ba d. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); d \<in> subjectReads (pasPolicy aag) (pasSubject aag); \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> equiv_asids (\<lambda>x. d = pasASIDAbs aag x) s t; cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba)\<rbrakk> \<Longrightarrow> equiv_asids (\<lambda>x. d = pasASIDAbs aag x) b ba
 3. \<And>s t b ba. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; affects_equiv aag l s t; equiv_for (\<lambda>x. True) underlying_memory (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) underlying_memory (machine_state t) (machine_state ba); equiv_for (\<lambda>x. True) device_state (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) device_state (machine_state t) (machine_state ba); equiv_for (\<lambda>_. True) cdt s b; equiv_for (\<lambda>_. True) cdt t ba; equiv_for (\<lambda>_. True) cdt_list s b; equiv_for (\<lambda>_. True) cdt_list t ba; equiv_for (\<lambda>_. True) ekheap s b; equiv_for (\<lambda>_. True) ekheap t ba; equiv_for (\<lambda>_. True) ready_queues s b; equiv_for (\<lambda>_. True) ready_queues t ba; equiv_for (\<lambda>_. True) is_original_cap s b; equiv_for (\<lambda>_. True) is_original_cap t ba; equiv_for (\<lambda>_. True) interrupt_states s b; equiv_for (\<lambda>_. True) interrupt_states t ba; equiv_for (\<lambda>_. True) interrupt_irq_node s b; equiv_for (\<lambda>_. True) interrupt_irq_node t ba; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))))\<rbrakk> \<Longrightarrow> affects_equiv aag l b ba proof (prove)
goal (4 subgoals):
 1. \<And>s t b ba x. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read aag x; \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> equiv_asids (\<lambda>x. d = pasASIDAbs aag x) s t; cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); x = a\<rbrakk> \<Longrightarrow> kheap b x = kheap ba x
 2. \<And>s t b ba x. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read aag x; \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> equiv_asids (\<lambda>x. d = pasASIDAbs aag x) s t; cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); x \<noteq> a\<rbrakk> \<Longrightarrow> kheap b x = kheap ba x
 3. \<And>s t b ba d. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); d \<in> subjectReads (pasPolicy aag) (pasSubject aag); \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> equiv_asids (\<lambda>x. d = pasASIDAbs aag x) s t; cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba)\<rbrakk> \<Longrightarrow> equiv_asids (\<lambda>x. d = pasASIDAbs aag x) b ba
 4. \<And>s t b ba. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; affects_equiv aag l s t; equiv_for (\<lambda>x. True) underlying_memory (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) underlying_memory (machine_state t) (machine_state ba); equiv_for (\<lambda>x. True) device_state (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) device_state (machine_state t) (machine_state ba); equiv_for (\<lambda>_. True) cdt s b; equiv_for (\<lambda>_. True) cdt t ba; equiv_for (\<lambda>_. True) cdt_list s b; equiv_for (\<lambda>_. True) cdt_list t ba; equiv_for (\<lambda>_. True) ekheap s b; equiv_for (\<lambda>_. True) ekheap t ba; equiv_for (\<lambda>_. True) ready_queues s b; equiv_for (\<lambda>_. True) ready_queues t ba; equiv_for (\<lambda>_. True) is_original_cap s b; equiv_for (\<lambda>_. True) is_original_cap t ba; equiv_for (\<lambda>_. True) interrupt_states s b; equiv_for (\<lambda>_. True) interrupt_states t ba; equiv_for (\<lambda>_. True) interrupt_irq_node s b; equiv_for (\<lambda>_. True) interrupt_irq_node t ba; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))))\<rbrakk> \<Longrightarrow> affects_equiv aag l b ba proof (prove)
goal (3 subgoals):
 1. \<And>s t b ba x. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read aag x; \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> equiv_asids (\<lambda>x. d = pasASIDAbs aag x) s t; cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); x \<noteq> a\<rbrakk> \<Longrightarrow> kheap b x = kheap ba x
 2. \<And>s t b ba d. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); d \<in> subjectReads (pasPolicy aag) (pasSubject aag); \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> equiv_asids (\<lambda>x. d = pasASIDAbs aag x) s t; cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba)\<rbrakk> \<Longrightarrow> equiv_asids (\<lambda>x. d = pasASIDAbs aag x) b ba
 3. \<And>s t b ba. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; affects_equiv aag l s t; equiv_for (\<lambda>x. True) underlying_memory (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) underlying_memory (machine_state t) (machine_state ba); equiv_for (\<lambda>x. True) device_state (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) device_state (machine_state t) (machine_state ba); equiv_for (\<lambda>_. True) cdt s b; equiv_for (\<lambda>_. True) cdt t ba; equiv_for (\<lambda>_. True) cdt_list s b; equiv_for (\<lambda>_. True) cdt_list t ba; equiv_for (\<lambda>_. True) ekheap s b; equiv_for (\<lambda>_. True) ekheap t ba; equiv_for (\<lambda>_. True) ready_queues s b; equiv_for (\<lambda>_. True) ready_queues t ba; equiv_for (\<lambda>_. True) is_original_cap s b; equiv_for (\<lambda>_. True) is_original_cap t ba; equiv_for (\<lambda>_. True) interrupt_states s b; equiv_for (\<lambda>_. True) interrupt_states t ba; equiv_for (\<lambda>_. True) interrupt_irq_node s b; equiv_for (\<lambda>_. True) interrupt_irq_node t ba; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))))\<rbrakk> \<Longrightarrow> affects_equiv aag l b ba proof (prove)
goal (2 subgoals):
 1. \<And>s t b ba d. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); d \<in> subjectReads (pasPolicy aag) (pasSubject aag); \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> equiv_asids (\<lambda>x. d = pasASIDAbs aag x) s t; cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba)\<rbrakk> \<Longrightarrow> equiv_asids (\<lambda>x. d = pasASIDAbs aag x) b ba
 2. \<And>s t b ba. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; affects_equiv aag l s t; equiv_for (\<lambda>x. True) underlying_memory (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) underlying_memory (machine_state t) (machine_state ba); equiv_for (\<lambda>x. True) device_state (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) device_state (machine_state t) (machine_state ba); equiv_for (\<lambda>_. True) cdt s b; equiv_for (\<lambda>_. True) cdt t ba; equiv_for (\<lambda>_. True) cdt_list s b; equiv_for (\<lambda>_. True) cdt_list t ba; equiv_for (\<lambda>_. True) ekheap s b; equiv_for (\<lambda>_. True) ekheap t ba; equiv_for (\<lambda>_. True) ready_queues s b; equiv_for (\<lambda>_. True) ready_queues t ba; equiv_for (\<lambda>_. True) is_original_cap s b; equiv_for (\<lambda>_. True) is_original_cap t ba; equiv_for (\<lambda>_. True) interrupt_states s b; equiv_for (\<lambda>_. True) interrupt_states t ba; equiv_for (\<lambda>_. True) interrupt_irq_node s b; equiv_for (\<lambda>_. True) interrupt_irq_node t ba; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))))\<rbrakk> \<Longrightarrow> affects_equiv aag l b ba proof (prove)
goal (3 subgoals):
 1. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> (\<forall>asid. asid \<noteq> 0 \<and> d = pasASIDAbs aag asid \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr\<rbrakk> \<Longrightarrow> typ_at (AArch AASIDPool) pool_ptr b = typ_at (AArch AASIDPool) pool_ptr ba
 2. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> (\<forall>asid. asid \<noteq> 0 \<and> d = pasASIDAbs aag asid \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr\<rbrakk> \<Longrightarrow> \<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida)
 3. \<And>s t b ba. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; affects_equiv aag l s t; equiv_for (\<lambda>x. True) underlying_memory (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) underlying_memory (machine_state t) (machine_state ba); equiv_for (\<lambda>x. True) device_state (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) device_state (machine_state t) (machine_state ba); equiv_for (\<lambda>_. True) cdt s b; equiv_for (\<lambda>_. True) cdt t ba; equiv_for (\<lambda>_. True) cdt_list s b; equiv_for (\<lambda>_. True) cdt_list t ba; equiv_for (\<lambda>_. True) ekheap s b; equiv_for (\<lambda>_. True) ekheap t ba; equiv_for (\<lambda>_. True) ready_queues s b; equiv_for (\<lambda>_. True) ready_queues t ba; equiv_for (\<lambda>_. True) is_original_cap s b; equiv_for (\<lambda>_. True) is_original_cap t ba; equiv_for (\<lambda>_. True) interrupt_states s b; equiv_for (\<lambda>_. True) interrupt_states t ba; equiv_for (\<lambda>_. True) interrupt_irq_node s b; equiv_for (\<lambda>_. True) interrupt_irq_node t ba; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))))\<rbrakk> \<Longrightarrow> affects_equiv aag l b ba proof (prove)
goal (4 subgoals):
 1. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> (\<forall>asid. asid \<noteq> 0 \<and> d = pasASIDAbs aag asid \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr; pool_ptr = a\<rbrakk> \<Longrightarrow> typ_at (AArch AASIDPool) pool_ptr b = typ_at (AArch AASIDPool) pool_ptr ba
 2. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> (\<forall>asid. asid \<noteq> 0 \<and> d = pasASIDAbs aag asid \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr; pool_ptr \<noteq> a\<rbrakk> \<Longrightarrow> typ_at (AArch AASIDPool) pool_ptr b = typ_at (AArch AASIDPool) pool_ptr ba
 3. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> (\<forall>asid. asid \<noteq> 0 \<and> d = pasASIDAbs aag asid \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr\<rbrakk> \<Longrightarrow> \<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida)
 4. \<And>s t b ba. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; affects_equiv aag l s t; equiv_for (\<lambda>x. True) underlying_memory (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) underlying_memory (machine_state t) (machine_state ba); equiv_for (\<lambda>x. True) device_state (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) device_state (machine_state t) (machine_state ba); equiv_for (\<lambda>_. True) cdt s b; equiv_for (\<lambda>_. True) cdt t ba; equiv_for (\<lambda>_. True) cdt_list s b; equiv_for (\<lambda>_. True) cdt_list t ba; equiv_for (\<lambda>_. True) ekheap s b; equiv_for (\<lambda>_. True) ekheap t ba; equiv_for (\<lambda>_. True) ready_queues s b; equiv_for (\<lambda>_. True) ready_queues t ba; equiv_for (\<lambda>_. True) is_original_cap s b; equiv_for (\<lambda>_. True) is_original_cap t ba; equiv_for (\<lambda>_. True) interrupt_states s b; equiv_for (\<lambda>_. True) interrupt_states t ba; equiv_for (\<lambda>_. True) interrupt_irq_node s b; equiv_for (\<lambda>_. True) interrupt_irq_node t ba; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))))\<rbrakk> \<Longrightarrow> affects_equiv aag l b ba proof (prove)
goal (4 subgoals):
 1. \<And>s t b ba asida. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> (\<forall>asid. asid \<noteq> 0 \<and> d = pasASIDAbs aag asid \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some a\<rbrakk> \<Longrightarrow> typ_at (AArch AASIDPool) a b = typ_at (AArch AASIDPool) a ba
 2. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> (\<forall>asid. asid \<noteq> 0 \<and> d = pasASIDAbs aag asid \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr; pool_ptr \<noteq> a\<rbrakk> \<Longrightarrow> typ_at (AArch AASIDPool) pool_ptr b = typ_at (AArch AASIDPool) pool_ptr ba
 3. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> (\<forall>asid. asid \<noteq> 0 \<and> d = pasASIDAbs aag asid \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr\<rbrakk> \<Longrightarrow> \<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida)
 4. \<And>s t b ba. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; affects_equiv aag l s t; equiv_for (\<lambda>x. True) underlying_memory (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) underlying_memory (machine_state t) (machine_state ba); equiv_for (\<lambda>x. True) device_state (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) device_state (machine_state t) (machine_state ba); equiv_for (\<lambda>_. True) cdt s b; equiv_for (\<lambda>_. True) cdt t ba; equiv_for (\<lambda>_. True) cdt_list s b; equiv_for (\<lambda>_. True) cdt_list t ba; equiv_for (\<lambda>_. True) ekheap s b; equiv_for (\<lambda>_. True) ekheap t ba; equiv_for (\<lambda>_. True) ready_queues s b; equiv_for (\<lambda>_. True) ready_queues t ba; equiv_for (\<lambda>_. True) is_original_cap s b; equiv_for (\<lambda>_. True) is_original_cap t ba; equiv_for (\<lambda>_. True) interrupt_states s b; equiv_for (\<lambda>_. True) interrupt_states t ba; equiv_for (\<lambda>_. True) interrupt_irq_node s b; equiv_for (\<lambda>_. True) interrupt_irq_node t ba; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))))\<rbrakk> \<Longrightarrow> affects_equiv aag l b ba proof (prove)
goal (5 subgoals):
 1. \<And>s t b ba asida. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some a; (\<forall>x. pasASIDAbs aag asid = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. pasASIDAbs aag asid = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. pasASIDAbs aag asid = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. pasASIDAbs aag asid = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. pasASIDAbs aag asid = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. pasASIDAbs aag asid = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. pasASIDAbs aag asid = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. pasASIDAbs aag asid = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. pasASIDAbs aag asid = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. pasASIDAbs aag asid \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> (\<forall>asida. asida \<noteq> 0 \<and> pasASIDAbs aag asid = pasASIDAbs aag asida \<longrightarrow> asid_table b (asid_high_bits_of asida) = asid_table ba (asid_high_bits_of asida) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asida) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida))))\<rbrakk> \<Longrightarrow> typ_at (AArch AASIDPool) a b = typ_at (AArch AASIDPool) a ba
 2. \<And>s t b ba asida. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some a; pasASIDAbs aag asid \<notin> subjectReads (pasPolicy aag) (pasSubject aag)\<rbrakk> \<Longrightarrow> typ_at (AArch AASIDPool) a b = typ_at (AArch AASIDPool) a ba
 3. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> (\<forall>asid. asid \<noteq> 0 \<and> d = pasASIDAbs aag asid \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr; pool_ptr \<noteq> a\<rbrakk> \<Longrightarrow> typ_at (AArch AASIDPool) pool_ptr b = typ_at (AArch AASIDPool) pool_ptr ba
 4. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> (\<forall>asid. asid \<noteq> 0 \<and> d = pasASIDAbs aag asid \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr\<rbrakk> \<Longrightarrow> \<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida)
 5. \<And>s t b ba. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; affects_equiv aag l s t; equiv_for (\<lambda>x. True) underlying_memory (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) underlying_memory (machine_state t) (machine_state ba); equiv_for (\<lambda>x. True) device_state (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) device_state (machine_state t) (machine_state ba); equiv_for (\<lambda>_. True) cdt s b; equiv_for (\<lambda>_. True) cdt t ba; equiv_for (\<lambda>_. True) cdt_list s b; equiv_for (\<lambda>_. True) cdt_list t ba; equiv_for (\<lambda>_. True) ekheap s b; equiv_for (\<lambda>_. True) ekheap t ba; equiv_for (\<lambda>_. True) ready_queues s b; equiv_for (\<lambda>_. True) ready_queues t ba; equiv_for (\<lambda>_. True) is_original_cap s b; equiv_for (\<lambda>_. True) is_original_cap t ba; equiv_for (\<lambda>_. True) interrupt_states s b; equiv_for (\<lambda>_. True) interrupt_states t ba; equiv_for (\<lambda>_. True) interrupt_irq_node s b; equiv_for (\<lambda>_. True) interrupt_irq_node t ba; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))))\<rbrakk> \<Longrightarrow> affects_equiv aag l b ba proof (prove)
goal (5 subgoals):
 1. \<And>s t b ba asida. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some a; \<forall>x. pasSubject aag = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x; \<forall>x. pasSubject aag = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x; \<forall>x. pasSubject aag = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x; \<forall>a. pasSubject aag = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb)); \<forall>x. pasSubject aag = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x; \<forall>a. pasSubject aag = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb)); \<forall>a. pasSubject aag = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb)); \<forall>x. pasSubject aag = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x; \<forall>x. pasSubject aag = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x; \<forall>x. pasSubject aag \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x; \<forall>asid. asid \<noteq> 0 \<and> pasSubject aag = pasASIDAbs aag asid \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))\<rbrakk> \<Longrightarrow> typ_at (AArch AASIDPool) a b = typ_at (AArch AASIDPool) a ba
 2. \<And>s t b ba asida. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some a; pasASIDAbs aag asid \<notin> subjectReads (pasPolicy aag) (pasSubject aag)\<rbrakk> \<Longrightarrow> typ_at (AArch AASIDPool) a b = typ_at (AArch AASIDPool) a ba
 3. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> (\<forall>asid. asid \<noteq> 0 \<and> d = pasASIDAbs aag asid \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr; pool_ptr \<noteq> a\<rbrakk> \<Longrightarrow> typ_at (AArch AASIDPool) pool_ptr b = typ_at (AArch AASIDPool) pool_ptr ba
 4. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> (\<forall>asid. asid \<noteq> 0 \<and> d = pasASIDAbs aag asid \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr\<rbrakk> \<Longrightarrow> \<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida)
 5. \<And>s t b ba. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; affects_equiv aag l s t; equiv_for (\<lambda>x. True) underlying_memory (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) underlying_memory (machine_state t) (machine_state ba); equiv_for (\<lambda>x. True) device_state (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) device_state (machine_state t) (machine_state ba); equiv_for (\<lambda>_. True) cdt s b; equiv_for (\<lambda>_. True) cdt t ba; equiv_for (\<lambda>_. True) cdt_list s b; equiv_for (\<lambda>_. True) cdt_list t ba; equiv_for (\<lambda>_. True) ekheap s b; equiv_for (\<lambda>_. True) ekheap t ba; equiv_for (\<lambda>_. True) ready_queues s b; equiv_for (\<lambda>_. True) ready_queues t ba; equiv_for (\<lambda>_. True) is_original_cap s b; equiv_for (\<lambda>_. True) is_original_cap t ba; equiv_for (\<lambda>_. True) interrupt_states s b; equiv_for (\<lambda>_. True) interrupt_states t ba; equiv_for (\<lambda>_. True) interrupt_irq_node s b; equiv_for (\<lambda>_. True) interrupt_irq_node t ba; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))))\<rbrakk> \<Longrightarrow> affects_equiv aag l b ba proof (prove)
goal (5 subgoals):
 1. \<And>s t b ba asida. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); aag_can_read_asid aag asida; cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some a; \<forall>x. pasSubject aag = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x; \<forall>x. pasSubject aag = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x; \<forall>x. pasSubject aag \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x; underlying_memory (machine_state s) asid = underlying_memory (machine_state b) asid; underlying_memory (machine_state t) asid = underlying_memory (machine_state ba) asid; device_state (machine_state s) asid = device_state (machine_state b) asid; device_state (machine_state t) asid = device_state (machine_state ba) asid; \<forall>ba. cdt s (asid, ba) = cdt b (asid, ba); \<forall>b. cdt t (asid, b) = cdt ba (asid, b); \<forall>ba. cdt_list s (asid, ba) = cdt_list b (asid, ba); \<forall>b. cdt_list t (asid, b) = cdt_list ba (asid, b); ekheap s asid = ekheap b asid; ekheap t asid = ekheap ba asid; \<forall>ba. is_original_cap s (asid, ba) = is_original_cap b (asid, ba); \<forall>b. is_original_cap t (asid, b) = is_original_cap ba (asid, b); asid \<noteq> a \<longrightarrow> kheap s asid = kheap b asid; asid \<noteq> a \<longrightarrow> kheap t asid = kheap ba asid; asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); pasSubject aag = pasObjectAbs aag asid \<longrightarrow> kheap s asid = kheap t asid; pasSubject aag = pasObjectAbs aag asid \<longrightarrow> underlying_memory (machine_state b) asid = underlying_memory (machine_state ba) asid; pasSubject aag = pasObjectAbs aag asid \<longrightarrow> device_state (machine_state b) asid = device_state (machine_state ba) asid; pasSubject aag = pasObjectAbs aag asid \<longrightarrow> (\<forall>bb. cdt b (asid, bb) = cdt ba (asid, bb)); pasSubject aag = pasObjectAbs aag asid \<longrightarrow> ekheap b asid = ekheap ba asid; pasSubject aag = pasObjectAbs aag asid \<longrightarrow> (\<forall>bb. cdt_list b (asid, bb) = cdt_list ba (asid, bb)); pasSubject aag = pasObjectAbs aag asid \<longrightarrow> (\<forall>bb. is_original_cap b (asid, bb) = is_original_cap ba (asid, bb)); asid \<noteq> 0 \<and> pasSubject aag = pasASIDAbs aag asid \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))\<rbrakk> \<Longrightarrow> typ_at (AArch AASIDPool) a b = typ_at (AArch AASIDPool) a ba
 2. \<And>s t b ba asida. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some a; pasASIDAbs aag asid \<notin> subjectReads (pasPolicy aag) (pasSubject aag)\<rbrakk> \<Longrightarrow> typ_at (AArch AASIDPool) a b = typ_at (AArch AASIDPool) a ba
 3. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> (\<forall>asid. asid \<noteq> 0 \<and> d = pasASIDAbs aag asid \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr; pool_ptr \<noteq> a\<rbrakk> \<Longrightarrow> typ_at (AArch AASIDPool) pool_ptr b = typ_at (AArch AASIDPool) pool_ptr ba
 4. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> (\<forall>asid. asid \<noteq> 0 \<and> d = pasASIDAbs aag asid \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr\<rbrakk> \<Longrightarrow> \<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida)
 5. \<And>s t b ba. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; affects_equiv aag l s t; equiv_for (\<lambda>x. True) underlying_memory (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) underlying_memory (machine_state t) (machine_state ba); equiv_for (\<lambda>x. True) device_state (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) device_state (machine_state t) (machine_state ba); equiv_for (\<lambda>_. True) cdt s b; equiv_for (\<lambda>_. True) cdt t ba; equiv_for (\<lambda>_. True) cdt_list s b; equiv_for (\<lambda>_. True) cdt_list t ba; equiv_for (\<lambda>_. True) ekheap s b; equiv_for (\<lambda>_. True) ekheap t ba; equiv_for (\<lambda>_. True) ready_queues s b; equiv_for (\<lambda>_. True) ready_queues t ba; equiv_for (\<lambda>_. True) is_original_cap s b; equiv_for (\<lambda>_. True) is_original_cap t ba; equiv_for (\<lambda>_. True) interrupt_states s b; equiv_for (\<lambda>_. True) interrupt_states t ba; equiv_for (\<lambda>_. True) interrupt_irq_node s b; equiv_for (\<lambda>_. True) interrupt_irq_node t ba; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))))\<rbrakk> \<Longrightarrow> affects_equiv aag l b ba proof (prove)
goal (4 subgoals):
 1. \<And>s t b ba asida. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some a; pasASIDAbs aag asid \<notin> subjectReads (pasPolicy aag) (pasSubject aag)\<rbrakk> \<Longrightarrow> typ_at (AArch AASIDPool) a b = typ_at (AArch AASIDPool) a ba
 2. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> (\<forall>asid. asid \<noteq> 0 \<and> d = pasASIDAbs aag asid \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr; pool_ptr \<noteq> a\<rbrakk> \<Longrightarrow> typ_at (AArch AASIDPool) pool_ptr b = typ_at (AArch AASIDPool) pool_ptr ba
 3. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> (\<forall>asid. asid \<noteq> 0 \<and> d = pasASIDAbs aag asid \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr\<rbrakk> \<Longrightarrow> \<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida)
 4. \<And>s t b ba. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; affects_equiv aag l s t; equiv_for (\<lambda>x. True) underlying_memory (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) underlying_memory (machine_state t) (machine_state ba); equiv_for (\<lambda>x. True) device_state (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) device_state (machine_state t) (machine_state ba); equiv_for (\<lambda>_. True) cdt s b; equiv_for (\<lambda>_. True) cdt t ba; equiv_for (\<lambda>_. True) cdt_list s b; equiv_for (\<lambda>_. True) cdt_list t ba; equiv_for (\<lambda>_. True) ekheap s b; equiv_for (\<lambda>_. True) ekheap t ba; equiv_for (\<lambda>_. True) ready_queues s b; equiv_for (\<lambda>_. True) ready_queues t ba; equiv_for (\<lambda>_. True) is_original_cap s b; equiv_for (\<lambda>_. True) is_original_cap t ba; equiv_for (\<lambda>_. True) interrupt_states s b; equiv_for (\<lambda>_. True) interrupt_states t ba; equiv_for (\<lambda>_. True) interrupt_irq_node s b; equiv_for (\<lambda>_. True) interrupt_irq_node t ba; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))))\<rbrakk> \<Longrightarrow> affects_equiv aag l b ba proof (prove)
goal (3 subgoals):
 1. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> (\<forall>asid. asid \<noteq> 0 \<and> d = pasASIDAbs aag asid \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr; pool_ptr \<noteq> a\<rbrakk> \<Longrightarrow> typ_at (AArch AASIDPool) pool_ptr b = typ_at (AArch AASIDPool) pool_ptr ba
 2. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> (\<forall>asid. asid \<noteq> 0 \<and> d = pasASIDAbs aag asid \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr\<rbrakk> \<Longrightarrow> \<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida)
 3. \<And>s t b ba. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; affects_equiv aag l s t; equiv_for (\<lambda>x. True) underlying_memory (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) underlying_memory (machine_state t) (machine_state ba); equiv_for (\<lambda>x. True) device_state (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) device_state (machine_state t) (machine_state ba); equiv_for (\<lambda>_. True) cdt s b; equiv_for (\<lambda>_. True) cdt t ba; equiv_for (\<lambda>_. True) cdt_list s b; equiv_for (\<lambda>_. True) cdt_list t ba; equiv_for (\<lambda>_. True) ekheap s b; equiv_for (\<lambda>_. True) ekheap t ba; equiv_for (\<lambda>_. True) ready_queues s b; equiv_for (\<lambda>_. True) ready_queues t ba; equiv_for (\<lambda>_. True) is_original_cap s b; equiv_for (\<lambda>_. True) is_original_cap t ba; equiv_for (\<lambda>_. True) interrupt_states s b; equiv_for (\<lambda>_. True) interrupt_states t ba; equiv_for (\<lambda>_. True) interrupt_irq_node s b; equiv_for (\<lambda>_. True) interrupt_irq_node t ba; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))))\<rbrakk> \<Longrightarrow> affects_equiv aag l b ba proof (prove)
goal (4 subgoals):
 1. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr; pool_ptr \<noteq> a; (\<forall>x. pasASIDAbs aag asida = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. pasASIDAbs aag asida = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. pasASIDAbs aag asida = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. pasASIDAbs aag asida = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. pasASIDAbs aag asida = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. pasASIDAbs aag asida = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. pasASIDAbs aag asida = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. pasASIDAbs aag asida = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. pasASIDAbs aag asida = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. pasASIDAbs aag asida \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> (\<forall>asid. asid \<noteq> 0 \<and> pasASIDAbs aag asida = pasASIDAbs aag asid \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))))\<rbrakk> \<Longrightarrow> typ_at (AArch AASIDPool) pool_ptr b = typ_at (AArch AASIDPool) pool_ptr ba
 2. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr; pool_ptr \<noteq> a; pasASIDAbs aag asida \<notin> subjectReads (pasPolicy aag) (pasSubject aag)\<rbrakk> \<Longrightarrow> typ_at (AArch AASIDPool) pool_ptr b = typ_at (AArch AASIDPool) pool_ptr ba
 3. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> (\<forall>asid. asid \<noteq> 0 \<and> d = pasASIDAbs aag asid \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr\<rbrakk> \<Longrightarrow> \<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida)
 4. \<And>s t b ba. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; affects_equiv aag l s t; equiv_for (\<lambda>x. True) underlying_memory (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) underlying_memory (machine_state t) (machine_state ba); equiv_for (\<lambda>x. True) device_state (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) device_state (machine_state t) (machine_state ba); equiv_for (\<lambda>_. True) cdt s b; equiv_for (\<lambda>_. True) cdt t ba; equiv_for (\<lambda>_. True) cdt_list s b; equiv_for (\<lambda>_. True) cdt_list t ba; equiv_for (\<lambda>_. True) ekheap s b; equiv_for (\<lambda>_. True) ekheap t ba; equiv_for (\<lambda>_. True) ready_queues s b; equiv_for (\<lambda>_. True) ready_queues t ba; equiv_for (\<lambda>_. True) is_original_cap s b; equiv_for (\<lambda>_. True) is_original_cap t ba; equiv_for (\<lambda>_. True) interrupt_states s b; equiv_for (\<lambda>_. True) interrupt_states t ba; equiv_for (\<lambda>_. True) interrupt_irq_node s b; equiv_for (\<lambda>_. True) interrupt_irq_node t ba; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))))\<rbrakk> \<Longrightarrow> affects_equiv aag l b ba proof (prove)
goal (4 subgoals):
 1. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr; pool_ptr \<noteq> a; \<forall>x. pasASIDAbs aag asida = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x; \<forall>x. pasASIDAbs aag asida = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x; \<forall>x. pasASIDAbs aag asida = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x; \<forall>a. pasASIDAbs aag asida = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb)); \<forall>x. pasASIDAbs aag asida = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x; \<forall>a. pasASIDAbs aag asida = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb)); \<forall>a. pasASIDAbs aag asida = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb)); \<forall>x. pasASIDAbs aag asida = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x; \<forall>x. pasASIDAbs aag asida = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x; \<forall>x. pasASIDAbs aag asida \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x; \<forall>asid. asid \<noteq> 0 \<and> pasASIDAbs aag asida = pasASIDAbs aag asid \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))\<rbrakk> \<Longrightarrow> typ_at (AArch AASIDPool) pool_ptr b = typ_at (AArch AASIDPool) pool_ptr ba
 2. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr; pool_ptr \<noteq> a; pasASIDAbs aag asida \<notin> subjectReads (pasPolicy aag) (pasSubject aag)\<rbrakk> \<Longrightarrow> typ_at (AArch AASIDPool) pool_ptr b = typ_at (AArch AASIDPool) pool_ptr ba
 3. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> (\<forall>asid. asid \<noteq> 0 \<and> d = pasASIDAbs aag asid \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr\<rbrakk> \<Longrightarrow> \<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida)
 4. \<And>s t b ba. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; affects_equiv aag l s t; equiv_for (\<lambda>x. True) underlying_memory (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) underlying_memory (machine_state t) (machine_state ba); equiv_for (\<lambda>x. True) device_state (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) device_state (machine_state t) (machine_state ba); equiv_for (\<lambda>_. True) cdt s b; equiv_for (\<lambda>_. True) cdt t ba; equiv_for (\<lambda>_. True) cdt_list s b; equiv_for (\<lambda>_. True) cdt_list t ba; equiv_for (\<lambda>_. True) ekheap s b; equiv_for (\<lambda>_. True) ekheap t ba; equiv_for (\<lambda>_. True) ready_queues s b; equiv_for (\<lambda>_. True) ready_queues t ba; equiv_for (\<lambda>_. True) is_original_cap s b; equiv_for (\<lambda>_. True) is_original_cap t ba; equiv_for (\<lambda>_. True) interrupt_states s b; equiv_for (\<lambda>_. True) interrupt_states t ba; equiv_for (\<lambda>_. True) interrupt_irq_node s b; equiv_for (\<lambda>_. True) interrupt_irq_node t ba; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))))\<rbrakk> \<Longrightarrow> affects_equiv aag l b ba proof (prove)
goal (4 subgoals):
 1. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); aag_can_read_asid aag asida; cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr; pool_ptr \<noteq> a; \<forall>x. pasASIDAbs aag asida = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x; \<forall>x. pasASIDAbs aag asida = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x; \<forall>x. pasASIDAbs aag asida \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x; underlying_memory (machine_state s) asida = underlying_memory (machine_state b) asida; underlying_memory (machine_state t) asida = underlying_memory (machine_state ba) asida; device_state (machine_state s) asida = device_state (machine_state b) asida; device_state (machine_state t) asida = device_state (machine_state ba) asida; \<forall>ba. cdt s (asida, ba) = cdt b (asida, ba); \<forall>b. cdt t (asida, b) = cdt ba (asida, b); \<forall>ba. cdt_list s (asida, ba) = cdt_list b (asida, ba); \<forall>b. cdt_list t (asida, b) = cdt_list ba (asida, b); ekheap s asida = ekheap b asida; ekheap t asida = ekheap ba asida; \<forall>ba. is_original_cap s (asida, ba) = is_original_cap b (asida, ba); \<forall>b. is_original_cap t (asida, b) = is_original_cap ba (asida, b); asida \<noteq> a \<longrightarrow> kheap s asida = kheap b asida; asida \<noteq> a \<longrightarrow> kheap t asida = kheap ba asida; asida \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asida) = asid_table b (asid_high_bits_of asida) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asida) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida)))); asida \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asida) = asid_table ba (asid_high_bits_of asida) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asida) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida)))); pasASIDAbs aag asida = pasObjectAbs aag asida \<longrightarrow> kheap s asida = kheap t asida; pasASIDAbs aag asida = pasObjectAbs aag asida \<longrightarrow> underlying_memory (machine_state b) asida = underlying_memory (machine_state ba) asida; pasASIDAbs aag asida = pasObjectAbs aag asida \<longrightarrow> device_state (machine_state b) asida = device_state (machine_state ba) asida; pasASIDAbs aag asida = pasObjectAbs aag asida \<longrightarrow> (\<forall>bb. cdt b (asida, bb) = cdt ba (asida, bb)); pasASIDAbs aag asida = pasObjectAbs aag asida \<longrightarrow> ekheap b asida = ekheap ba asida; pasASIDAbs aag asida = pasObjectAbs aag asida \<longrightarrow> (\<forall>bb. cdt_list b (asida, bb) = cdt_list ba (asida, bb)); pasASIDAbs aag asida = pasObjectAbs aag asida \<longrightarrow> (\<forall>bb. is_original_cap b (asida, bb) = is_original_cap ba (asida, bb)); asida \<noteq> 0 \<and> pasASIDAbs aag asida = pasASIDAbs aag asida \<longrightarrow> asid_table b (asid_high_bits_of asida) = asid_table ba (asid_high_bits_of asida) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asida) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida)))\<rbrakk> \<Longrightarrow> typ_at (AArch AASIDPool) pool_ptr b = typ_at (AArch AASIDPool) pool_ptr ba
 2. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr; pool_ptr \<noteq> a; pasASIDAbs aag asida \<notin> subjectReads (pasPolicy aag) (pasSubject aag)\<rbrakk> \<Longrightarrow> typ_at (AArch AASIDPool) pool_ptr b = typ_at (AArch AASIDPool) pool_ptr ba
 3. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> (\<forall>asid. asid \<noteq> 0 \<and> d = pasASIDAbs aag asid \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr\<rbrakk> \<Longrightarrow> \<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida)
 4. \<And>s t b ba. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; affects_equiv aag l s t; equiv_for (\<lambda>x. True) underlying_memory (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) underlying_memory (machine_state t) (machine_state ba); equiv_for (\<lambda>x. True) device_state (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) device_state (machine_state t) (machine_state ba); equiv_for (\<lambda>_. True) cdt s b; equiv_for (\<lambda>_. True) cdt t ba; equiv_for (\<lambda>_. True) cdt_list s b; equiv_for (\<lambda>_. True) cdt_list t ba; equiv_for (\<lambda>_. True) ekheap s b; equiv_for (\<lambda>_. True) ekheap t ba; equiv_for (\<lambda>_. True) ready_queues s b; equiv_for (\<lambda>_. True) ready_queues t ba; equiv_for (\<lambda>_. True) is_original_cap s b; equiv_for (\<lambda>_. True) is_original_cap t ba; equiv_for (\<lambda>_. True) interrupt_states s b; equiv_for (\<lambda>_. True) interrupt_states t ba; equiv_for (\<lambda>_. True) interrupt_irq_node s b; equiv_for (\<lambda>_. True) interrupt_irq_node t ba; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))))\<rbrakk> \<Longrightarrow> affects_equiv aag l b ba proof (prove)
goal (3 subgoals):
 1. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr; pool_ptr \<noteq> a; pasASIDAbs aag asida \<notin> subjectReads (pasPolicy aag) (pasSubject aag)\<rbrakk> \<Longrightarrow> typ_at (AArch AASIDPool) pool_ptr b = typ_at (AArch AASIDPool) pool_ptr ba
 2. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> (\<forall>asid. asid \<noteq> 0 \<and> d = pasASIDAbs aag asid \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr\<rbrakk> \<Longrightarrow> \<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida)
 3. \<And>s t b ba. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; affects_equiv aag l s t; equiv_for (\<lambda>x. True) underlying_memory (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) underlying_memory (machine_state t) (machine_state ba); equiv_for (\<lambda>x. True) device_state (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) device_state (machine_state t) (machine_state ba); equiv_for (\<lambda>_. True) cdt s b; equiv_for (\<lambda>_. True) cdt t ba; equiv_for (\<lambda>_. True) cdt_list s b; equiv_for (\<lambda>_. True) cdt_list t ba; equiv_for (\<lambda>_. True) ekheap s b; equiv_for (\<lambda>_. True) ekheap t ba; equiv_for (\<lambda>_. True) ready_queues s b; equiv_for (\<lambda>_. True) ready_queues t ba; equiv_for (\<lambda>_. True) is_original_cap s b; equiv_for (\<lambda>_. True) is_original_cap t ba; equiv_for (\<lambda>_. True) interrupt_states s b; equiv_for (\<lambda>_. True) interrupt_states t ba; equiv_for (\<lambda>_. True) interrupt_irq_node s b; equiv_for (\<lambda>_. True) interrupt_irq_node t ba; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))))\<rbrakk> \<Longrightarrow> affects_equiv aag l b ba proof (prove)
goal (2 subgoals):
 1. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> (\<forall>asid. asid \<noteq> 0 \<and> d = pasASIDAbs aag asid \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr\<rbrakk> \<Longrightarrow> \<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida)
 2. \<And>s t b ba. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; affects_equiv aag l s t; equiv_for (\<lambda>x. True) underlying_memory (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) underlying_memory (machine_state t) (machine_state ba); equiv_for (\<lambda>x. True) device_state (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) device_state (machine_state t) (machine_state ba); equiv_for (\<lambda>_. True) cdt s b; equiv_for (\<lambda>_. True) cdt t ba; equiv_for (\<lambda>_. True) cdt_list s b; equiv_for (\<lambda>_. True) cdt_list t ba; equiv_for (\<lambda>_. True) ekheap s b; equiv_for (\<lambda>_. True) ekheap t ba; equiv_for (\<lambda>_. True) ready_queues s b; equiv_for (\<lambda>_. True) ready_queues t ba; equiv_for (\<lambda>_. True) is_original_cap s b; equiv_for (\<lambda>_. True) is_original_cap t ba; equiv_for (\<lambda>_. True) interrupt_states s b; equiv_for (\<lambda>_. True) interrupt_states t ba; equiv_for (\<lambda>_. True) interrupt_irq_node s b; equiv_for (\<lambda>_. True) interrupt_irq_node t ba; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))))\<rbrakk> \<Longrightarrow> affects_equiv aag l b ba proof (prove)
goal (2 subgoals):
 1. \<And>s t b ba asida pool_ptr asid_pool asid_pool'. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> (\<forall>asid. asid \<noteq> 0 \<and> d = pasASIDAbs aag asid \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr; kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)); kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool'))\<rbrakk> \<Longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida)
 2. \<And>s t b ba. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; affects_equiv aag l s t; equiv_for (\<lambda>x. True) underlying_memory (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) underlying_memory (machine_state t) (machine_state ba); equiv_for (\<lambda>x. True) device_state (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) device_state (machine_state t) (machine_state ba); equiv_for (\<lambda>_. True) cdt s b; equiv_for (\<lambda>_. True) cdt t ba; equiv_for (\<lambda>_. True) cdt_list s b; equiv_for (\<lambda>_. True) cdt_list t ba; equiv_for (\<lambda>_. True) ekheap s b; equiv_for (\<lambda>_. True) ekheap t ba; equiv_for (\<lambda>_. True) ready_queues s b; equiv_for (\<lambda>_. True) ready_queues t ba; equiv_for (\<lambda>_. True) is_original_cap s b; equiv_for (\<lambda>_. True) is_original_cap t ba; equiv_for (\<lambda>_. True) interrupt_states s b; equiv_for (\<lambda>_. True) interrupt_states t ba; equiv_for (\<lambda>_. True) interrupt_irq_node s b; equiv_for (\<lambda>_. True) interrupt_irq_node t ba; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))))\<rbrakk> \<Longrightarrow> affects_equiv aag l b ba proof (prove)
goal (3 subgoals):
 1. \<And>s t b ba asida pool_ptr asid_pool asid_pool'. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> (\<forall>asid. asid \<noteq> 0 \<and> d = pasASIDAbs aag asid \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr; kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)); kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')); pool_ptr = a\<rbrakk> \<Longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida)
 2. \<And>s t b ba asida pool_ptr asid_pool asid_pool'. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> (\<forall>asid. asid \<noteq> 0 \<and> d = pasASIDAbs aag asid \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr; kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)); kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')); pool_ptr \<noteq> a\<rbrakk> \<Longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida)
 3. \<And>s t b ba. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; affects_equiv aag l s t; equiv_for (\<lambda>x. True) underlying_memory (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) underlying_memory (machine_state t) (machine_state ba); equiv_for (\<lambda>x. True) device_state (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) device_state (machine_state t) (machine_state ba); equiv_for (\<lambda>_. True) cdt s b; equiv_for (\<lambda>_. True) cdt t ba; equiv_for (\<lambda>_. True) cdt_list s b; equiv_for (\<lambda>_. True) cdt_list t ba; equiv_for (\<lambda>_. True) ekheap s b; equiv_for (\<lambda>_. True) ekheap t ba; equiv_for (\<lambda>_. True) ready_queues s b; equiv_for (\<lambda>_. True) ready_queues t ba; equiv_for (\<lambda>_. True) is_original_cap s b; equiv_for (\<lambda>_. True) is_original_cap t ba; equiv_for (\<lambda>_. True) interrupt_states s b; equiv_for (\<lambda>_. True) interrupt_states t ba; equiv_for (\<lambda>_. True) interrupt_irq_node s b; equiv_for (\<lambda>_. True) interrupt_irq_node t ba; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))))\<rbrakk> \<Longrightarrow> affects_equiv aag l b ba proof (prove)
goal (4 subgoals):
 1. \<And>s t b ba asida pool_ptr asid_pool asid_pool'. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr; kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)); kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')); pool_ptr = a; (\<forall>x. pasASIDAbs aag asida = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. pasASIDAbs aag asida = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. pasASIDAbs aag asida = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. pasASIDAbs aag asida = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. pasASIDAbs aag asida = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. pasASIDAbs aag asida = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. pasASIDAbs aag asida = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. pasASIDAbs aag asida = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. pasASIDAbs aag asida = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. pasASIDAbs aag asida \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> (\<forall>asid. asid \<noteq> 0 \<and> pasASIDAbs aag asida = pasASIDAbs aag asid \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))))\<rbrakk> \<Longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida)
 2. \<And>s t b ba asida pool_ptr asid_pool asid_pool'. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr; kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)); kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')); pool_ptr = a; pasASIDAbs aag asida \<notin> subjectReads (pasPolicy aag) (pasSubject aag)\<rbrakk> \<Longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida)
 3. \<And>s t b ba asida pool_ptr asid_pool asid_pool'. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; affects_equiv aag l s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread ba; cur_thread t = cur_thread ba; cur_domain s = cur_domain ba; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action ba; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed ba; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state ba); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_read_asid aag asida; \<forall>d\<in>subjectReads (pasPolicy aag) (pasSubject aag). (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> kheap s x = kheap t x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb))) \<and> (\<forall>x. d = pasObjectAbs aag x \<longrightarrow> ekheap b x = ekheap ba x) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb))) \<and> (\<forall>a. d = pasObjectAbs aag a \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb))) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_states b x = interrupt_states ba x) \<and> (\<forall>x. d = pasIRQAbs aag x \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x) \<and> (\<forall>x. d \<in> pasDomainAbs aag x \<longrightarrow> ready_queues b x = ready_queues ba x) \<and> (\<forall>asid. asid \<noteq> 0 \<and> d = pasASIDAbs aag asid \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); cur_thread b = cur_thread ba; cur_domain b = cur_domain ba; scheduler_action b = scheduler_action ba; work_units_completed b = work_units_completed ba; equiv_irq_state (machine_state b) (machine_state ba); asida \<noteq> 0; asid_table ba (asid_high_bits_of asida) = Some pool_ptr; kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)); kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')); pool_ptr \<noteq> a\<rbrakk> \<Longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida)
 4. \<And>s t b ba. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; affects_equiv aag l s t; equiv_for (\<lambda>x. True) underlying_memory (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) underlying_memory (machine_state t) (machine_state ba); equiv_for (\<lambda>x. True) device_state (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) device_state (machine_state t) (machine_state ba); equiv_for (\<lambda>_. True) cdt s b; equiv_for (\<lambda>_. True) cdt t ba; equiv_for (\<lambda>_. True) cdt_list s b; equiv_for (\<lambda>_. True) cdt_list t ba; equiv_for (\<lambda>_. True) ekheap s b; equiv_for (\<lambda>_. True) ekheap t ba; equiv_for (\<lambda>_. True) ready_queues s b; equiv_for (\<lambda>_. True) ready_queues t ba; equiv_for (\<lambda>_. True) is_original_cap s b; equiv_for (\<lambda>_. True) is_original_cap t ba; equiv_for (\<lambda>_. True) interrupt_states s b; equiv_for (\<lambda>_. True) interrupt_states t ba; equiv_for (\<lambda>_. True) interrupt_irq_node s b; equiv_for (\<lambda>_. True) interrupt_irq_node t ba; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))))\<rbrakk> \<Longrightarrow> affects_equiv aag l b ba proof (prove)
goal (1 subgoal):
 1. \<And>s t b ba. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; affects_equiv aag l s t; equiv_for (\<lambda>x. True) underlying_memory (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) underlying_memory (machine_state t) (machine_state ba); equiv_for (\<lambda>x. True) device_state (machine_state s) (machine_state b); equiv_for (\<lambda>x. True) device_state (machine_state t) (machine_state ba); equiv_for (\<lambda>_. True) cdt s b; equiv_for (\<lambda>_. True) cdt t ba; equiv_for (\<lambda>_. True) cdt_list s b; equiv_for (\<lambda>_. True) cdt_list t ba; equiv_for (\<lambda>_. True) ekheap s b; equiv_for (\<lambda>_. True) ekheap t ba; equiv_for (\<lambda>_. True) ready_queues s b; equiv_for (\<lambda>_. True) ready_queues t ba; equiv_for (\<lambda>_. True) is_original_cap s b; equiv_for (\<lambda>_. True) is_original_cap t ba; equiv_for (\<lambda>_. True) interrupt_states s b; equiv_for (\<lambda>_. True) interrupt_states t ba; equiv_for (\<lambda>_. True) interrupt_irq_node s b; equiv_for (\<lambda>_. True) interrupt_irq_node t ba; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))))\<rbrakk> \<Longrightarrow> affects_equiv aag l b ba proof (prove)
goal (2 subgoals):
 1. \<And>s t b ba x. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_affect_label aag l; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> kheap s x = kheap t x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb)); \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> ekheap b x = ekheap ba x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb)); \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb)); \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_states b x = interrupt_states ba x; \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x; \<forall>x. (\<exists>la\<in>pasDomainAbs aag x. la \<in> subjectReads (pasPolicy aag) l) \<longrightarrow> ready_queues b x = ready_queues ba x; equiv_asids (\<lambda>x. pasASIDAbs aag x \<in> subjectReads (pasPolicy aag) l) s t; pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l\<rbrakk> \<Longrightarrow> kheap b x = kheap ba x
 2. \<And>s t b ba. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_affect_label aag l; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> kheap s x = kheap t x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb)); \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> ekheap b x = ekheap ba x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb)); \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb)); \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_states b x = interrupt_states ba x; \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x; \<forall>x. (\<exists>la\<in>pasDomainAbs aag x. la \<in> subjectReads (pasPolicy aag) l) \<longrightarrow> ready_queues b x = ready_queues ba x; equiv_asids (\<lambda>x. pasASIDAbs aag x \<in> subjectReads (pasPolicy aag) l) s t\<rbrakk> \<Longrightarrow> equiv_asids (\<lambda>x. pasASIDAbs aag x \<in> subjectReads (pasPolicy aag) l) b ba proof (prove)
goal (3 subgoals):
 1. \<And>s t b ba x. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_affect_label aag l; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> kheap s x = kheap t x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb)); \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> ekheap b x = ekheap ba x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb)); \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb)); \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_states b x = interrupt_states ba x; \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x; \<forall>x. (\<exists>la\<in>pasDomainAbs aag x. la \<in> subjectReads (pasPolicy aag) l) \<longrightarrow> ready_queues b x = ready_queues ba x; equiv_asids (\<lambda>x. pasASIDAbs aag x \<in> subjectReads (pasPolicy aag) l) s t; pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l; x = a\<rbrakk> \<Longrightarrow> kheap b x = kheap ba x
 2. \<And>s t b ba x. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_affect_label aag l; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> kheap s x = kheap t x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb)); \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> ekheap b x = ekheap ba x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb)); \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb)); \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_states b x = interrupt_states ba x; \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x; \<forall>x. (\<exists>la\<in>pasDomainAbs aag x. la \<in> subjectReads (pasPolicy aag) l) \<longrightarrow> ready_queues b x = ready_queues ba x; equiv_asids (\<lambda>x. pasASIDAbs aag x \<in> subjectReads (pasPolicy aag) l) s t; pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l; x \<noteq> a\<rbrakk> \<Longrightarrow> kheap b x = kheap ba x
 3. \<And>s t b ba. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_affect_label aag l; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> kheap s x = kheap t x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb)); \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> ekheap b x = ekheap ba x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb)); \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb)); \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_states b x = interrupt_states ba x; \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x; \<forall>x. (\<exists>la\<in>pasDomainAbs aag x. la \<in> subjectReads (pasPolicy aag) l) \<longrightarrow> ready_queues b x = ready_queues ba x; equiv_asids (\<lambda>x. pasASIDAbs aag x \<in> subjectReads (pasPolicy aag) l) s t\<rbrakk> \<Longrightarrow> equiv_asids (\<lambda>x. pasASIDAbs aag x \<in> subjectReads (pasPolicy aag) l) b ba proof (prove)
goal (2 subgoals):
 1. \<And>s t b ba x. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_affect_label aag l; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> kheap s x = kheap t x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb)); \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> ekheap b x = ekheap ba x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb)); \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb)); \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_states b x = interrupt_states ba x; \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x; \<forall>x. (\<exists>la\<in>pasDomainAbs aag x. la \<in> subjectReads (pasPolicy aag) l) \<longrightarrow> ready_queues b x = ready_queues ba x; equiv_asids (\<lambda>x. pasASIDAbs aag x \<in> subjectReads (pasPolicy aag) l) s t; pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l; x \<noteq> a\<rbrakk> \<Longrightarrow> kheap b x = kheap ba x
 2. \<And>s t b ba. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_affect_label aag l; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> kheap s x = kheap t x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb)); \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> ekheap b x = ekheap ba x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb)); \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb)); \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_states b x = interrupt_states ba x; \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x; \<forall>x. (\<exists>la\<in>pasDomainAbs aag x. la \<in> subjectReads (pasPolicy aag) l) \<longrightarrow> ready_queues b x = ready_queues ba x; equiv_asids (\<lambda>x. pasASIDAbs aag x \<in> subjectReads (pasPolicy aag) l) s t\<rbrakk> \<Longrightarrow> equiv_asids (\<lambda>x. pasASIDAbs aag x \<in> subjectReads (pasPolicy aag) l) b ba proof (prove)
goal (1 subgoal):
 1. \<And>s t b ba. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_affect_label aag l; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> kheap s x = kheap t x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb)); \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> ekheap b x = ekheap ba x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb)); \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb)); \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_states b x = interrupt_states ba x; \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x; \<forall>x. (\<exists>la\<in>pasDomainAbs aag x. la \<in> subjectReads (pasPolicy aag) l) \<longrightarrow> ready_queues b x = ready_queues ba x; equiv_asids (\<lambda>x. pasASIDAbs aag x \<in> subjectReads (pasPolicy aag) l) s t\<rbrakk> \<Longrightarrow> equiv_asids (\<lambda>x. pasASIDAbs aag x \<in> subjectReads (pasPolicy aag) l) b ba proof (prove)
goal (2 subgoals):
 1. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_affect_label aag l; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> kheap s x = kheap t x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb)); \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> ekheap b x = ekheap ba x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb)); \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb)); \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_states b x = interrupt_states ba x; \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x; \<forall>x. (\<exists>la\<in>pasDomainAbs aag x. la \<in> subjectReads (pasPolicy aag) l) \<longrightarrow> ready_queues b x = ready_queues ba x; \<forall>asid. asid \<noteq> 0 \<and> pasASIDAbs aag asid \<in> subjectReads (pasPolicy aag) l \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))); asida \<noteq> 0; pasASIDAbs aag asida \<in> subjectReads (pasPolicy aag) l; asid_table ba (asid_high_bits_of asida) = Some pool_ptr\<rbrakk> \<Longrightarrow> typ_at (AArch AASIDPool) pool_ptr b = typ_at (AArch AASIDPool) pool_ptr ba
 2. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_affect_label aag l; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> kheap s x = kheap t x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb)); \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> ekheap b x = ekheap ba x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb)); \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb)); \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_states b x = interrupt_states ba x; \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x; \<forall>x. (\<exists>la\<in>pasDomainAbs aag x. la \<in> subjectReads (pasPolicy aag) l) \<longrightarrow> ready_queues b x = ready_queues ba x; \<forall>asid. asid \<noteq> 0 \<and> pasASIDAbs aag asid \<in> subjectReads (pasPolicy aag) l \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))); asida \<noteq> 0; pasASIDAbs aag asida \<in> subjectReads (pasPolicy aag) l; asid_table ba (asid_high_bits_of asida) = Some pool_ptr\<rbrakk> \<Longrightarrow> \<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida) proof (prove)
goal (3 subgoals):
 1. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_affect_label aag l; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> kheap s x = kheap t x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb)); \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> ekheap b x = ekheap ba x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb)); \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb)); \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_states b x = interrupt_states ba x; \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x; \<forall>x. (\<exists>la\<in>pasDomainAbs aag x. la \<in> subjectReads (pasPolicy aag) l) \<longrightarrow> ready_queues b x = ready_queues ba x; \<forall>asid. asid \<noteq> 0 \<and> pasASIDAbs aag asid \<in> subjectReads (pasPolicy aag) l \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))); asida \<noteq> 0; pasASIDAbs aag asida \<in> subjectReads (pasPolicy aag) l; asid_table ba (asid_high_bits_of asida) = Some pool_ptr; pool_ptr = a\<rbrakk> \<Longrightarrow> typ_at (AArch AASIDPool) pool_ptr b = typ_at (AArch AASIDPool) pool_ptr ba
 2. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_affect_label aag l; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> kheap s x = kheap t x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb)); \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> ekheap b x = ekheap ba x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb)); \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb)); \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_states b x = interrupt_states ba x; \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x; \<forall>x. (\<exists>la\<in>pasDomainAbs aag x. la \<in> subjectReads (pasPolicy aag) l) \<longrightarrow> ready_queues b x = ready_queues ba x; \<forall>asid. asid \<noteq> 0 \<and> pasASIDAbs aag asid \<in> subjectReads (pasPolicy aag) l \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))); asida \<noteq> 0; pasASIDAbs aag asida \<in> subjectReads (pasPolicy aag) l; asid_table ba (asid_high_bits_of asida) = Some pool_ptr; pool_ptr \<noteq> a\<rbrakk> \<Longrightarrow> typ_at (AArch AASIDPool) pool_ptr b = typ_at (AArch AASIDPool) pool_ptr ba
 3. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_affect_label aag l; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> kheap s x = kheap t x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb)); \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> ekheap b x = ekheap ba x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb)); \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb)); \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_states b x = interrupt_states ba x; \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x; \<forall>x. (\<exists>la\<in>pasDomainAbs aag x. la \<in> subjectReads (pasPolicy aag) l) \<longrightarrow> ready_queues b x = ready_queues ba x; \<forall>asid. asid \<noteq> 0 \<and> pasASIDAbs aag asid \<in> subjectReads (pasPolicy aag) l \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))); asida \<noteq> 0; pasASIDAbs aag asida \<in> subjectReads (pasPolicy aag) l; asid_table ba (asid_high_bits_of asida) = Some pool_ptr\<rbrakk> \<Longrightarrow> \<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida) proof (prove)
goal (3 subgoals):
 1. \<And>s t b ba asida. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_affect_label aag l; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> kheap s x = kheap t x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb)); \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> ekheap b x = ekheap ba x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb)); \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb)); \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_states b x = interrupt_states ba x; \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x; \<forall>x. (\<exists>la\<in>pasDomainAbs aag x. la \<in> subjectReads (pasPolicy aag) l) \<longrightarrow> ready_queues b x = ready_queues ba x; \<forall>asid. asid \<noteq> 0 \<and> pasASIDAbs aag asid \<in> subjectReads (pasPolicy aag) l \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))); asida \<noteq> 0; pasASIDAbs aag asida \<in> subjectReads (pasPolicy aag) l; asid_table ba (asid_high_bits_of asida) = Some a\<rbrakk> \<Longrightarrow> typ_at (AArch AASIDPool) a b = typ_at (AArch AASIDPool) a ba
 2. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_affect_label aag l; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> kheap s x = kheap t x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb)); \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> ekheap b x = ekheap ba x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb)); \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb)); \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_states b x = interrupt_states ba x; \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x; \<forall>x. (\<exists>la\<in>pasDomainAbs aag x. la \<in> subjectReads (pasPolicy aag) l) \<longrightarrow> ready_queues b x = ready_queues ba x; \<forall>asid. asid \<noteq> 0 \<and> pasASIDAbs aag asid \<in> subjectReads (pasPolicy aag) l \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))); asida \<noteq> 0; pasASIDAbs aag asida \<in> subjectReads (pasPolicy aag) l; asid_table ba (asid_high_bits_of asida) = Some pool_ptr; pool_ptr \<noteq> a\<rbrakk> \<Longrightarrow> typ_at (AArch AASIDPool) pool_ptr b = typ_at (AArch AASIDPool) pool_ptr ba
 3. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_affect_label aag l; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> kheap s x = kheap t x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb)); \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> ekheap b x = ekheap ba x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb)); \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb)); \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_states b x = interrupt_states ba x; \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x; \<forall>x. (\<exists>la\<in>pasDomainAbs aag x. la \<in> subjectReads (pasPolicy aag) l) \<longrightarrow> ready_queues b x = ready_queues ba x; \<forall>asid. asid \<noteq> 0 \<and> pasASIDAbs aag asid \<in> subjectReads (pasPolicy aag) l \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))); asida \<noteq> 0; pasASIDAbs aag asida \<in> subjectReads (pasPolicy aag) l; asid_table ba (asid_high_bits_of asida) = Some pool_ptr\<rbrakk> \<Longrightarrow> \<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida) proof (prove)
goal (3 subgoals):
 1. \<And>s t b ba asida. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); aag_can_affect_label aag l; \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_states b x = interrupt_states ba x; \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x; \<forall>x. (\<exists>la\<in>pasDomainAbs aag x. la \<in> subjectReads (pasPolicy aag) l) \<longrightarrow> ready_queues b x = ready_queues ba x; asida \<noteq> 0; pasASIDAbs aag asida \<in> subjectReads (pasPolicy aag) l; asid_table ba (asid_high_bits_of asida) = Some a; underlying_memory (machine_state s) asid = underlying_memory (machine_state b) asid; underlying_memory (machine_state t) asid = underlying_memory (machine_state ba) asid; device_state (machine_state s) asid = device_state (machine_state b) asid; device_state (machine_state t) asid = device_state (machine_state ba) asid; \<forall>ba. cdt s (asid, ba) = cdt b (asid, ba); \<forall>b. cdt t (asid, b) = cdt ba (asid, b); \<forall>ba. cdt_list s (asid, ba) = cdt_list b (asid, ba); \<forall>b. cdt_list t (asid, b) = cdt_list ba (asid, b); ekheap s asid = ekheap b asid; ekheap t asid = ekheap ba asid; \<forall>ba. is_original_cap s (asid, ba) = is_original_cap b (asid, ba); \<forall>b. is_original_cap t (asid, b) = is_original_cap ba (asid, b); asid \<noteq> a \<longrightarrow> kheap s asid = kheap b asid; asid \<noteq> a \<longrightarrow> kheap t asid = kheap ba asid; asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); pasObjectAbs aag asid \<in> subjectReads (pasPolicy aag) l \<longrightarrow> kheap s asid = kheap t asid; pasObjectAbs aag asid \<in> subjectReads (pasPolicy aag) l \<longrightarrow> underlying_memory (machine_state b) asid = underlying_memory (machine_state ba) asid; pasObjectAbs aag asid \<in> subjectReads (pasPolicy aag) l \<longrightarrow> device_state (machine_state b) asid = device_state (machine_state ba) asid; pasObjectAbs aag asid \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt b (asid, bb) = cdt ba (asid, bb)); pasObjectAbs aag asid \<in> subjectReads (pasPolicy aag) l \<longrightarrow> ekheap b asid = ekheap ba asid; pasObjectAbs aag asid \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt_list b (asid, bb) = cdt_list ba (asid, bb)); pasObjectAbs aag asid \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. is_original_cap b (asid, bb) = is_original_cap ba (asid, bb)); asid \<noteq> 0 \<and> pasASIDAbs aag asid \<in> subjectReads (pasPolicy aag) l \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))\<rbrakk> \<Longrightarrow> typ_at (AArch AASIDPool) a b = typ_at (AArch AASIDPool) a ba
 2. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_affect_label aag l; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> kheap s x = kheap t x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb)); \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> ekheap b x = ekheap ba x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb)); \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb)); \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_states b x = interrupt_states ba x; \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x; \<forall>x. (\<exists>la\<in>pasDomainAbs aag x. la \<in> subjectReads (pasPolicy aag) l) \<longrightarrow> ready_queues b x = ready_queues ba x; \<forall>asid. asid \<noteq> 0 \<and> pasASIDAbs aag asid \<in> subjectReads (pasPolicy aag) l \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))); asida \<noteq> 0; pasASIDAbs aag asida \<in> subjectReads (pasPolicy aag) l; asid_table ba (asid_high_bits_of asida) = Some pool_ptr; pool_ptr \<noteq> a\<rbrakk> \<Longrightarrow> typ_at (AArch AASIDPool) pool_ptr b = typ_at (AArch AASIDPool) pool_ptr ba
 3. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_affect_label aag l; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> kheap s x = kheap t x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb)); \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> ekheap b x = ekheap ba x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb)); \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb)); \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_states b x = interrupt_states ba x; \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x; \<forall>x. (\<exists>la\<in>pasDomainAbs aag x. la \<in> subjectReads (pasPolicy aag) l) \<longrightarrow> ready_queues b x = ready_queues ba x; \<forall>asid. asid \<noteq> 0 \<and> pasASIDAbs aag asid \<in> subjectReads (pasPolicy aag) l \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))); asida \<noteq> 0; pasASIDAbs aag asida \<in> subjectReads (pasPolicy aag) l; asid_table ba (asid_high_bits_of asida) = Some pool_ptr\<rbrakk> \<Longrightarrow> \<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida) proof (prove)
goal (2 subgoals):
 1. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_affect_label aag l; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> kheap s x = kheap t x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb)); \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> ekheap b x = ekheap ba x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb)); \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb)); \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_states b x = interrupt_states ba x; \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x; \<forall>x. (\<exists>la\<in>pasDomainAbs aag x. la \<in> subjectReads (pasPolicy aag) l) \<longrightarrow> ready_queues b x = ready_queues ba x; \<forall>asid. asid \<noteq> 0 \<and> pasASIDAbs aag asid \<in> subjectReads (pasPolicy aag) l \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))); asida \<noteq> 0; pasASIDAbs aag asida \<in> subjectReads (pasPolicy aag) l; asid_table ba (asid_high_bits_of asida) = Some pool_ptr; pool_ptr \<noteq> a\<rbrakk> \<Longrightarrow> typ_at (AArch AASIDPool) pool_ptr b = typ_at (AArch AASIDPool) pool_ptr ba
 2. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_affect_label aag l; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> kheap s x = kheap t x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb)); \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> ekheap b x = ekheap ba x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb)); \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb)); \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_states b x = interrupt_states ba x; \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x; \<forall>x. (\<exists>la\<in>pasDomainAbs aag x. la \<in> subjectReads (pasPolicy aag) l) \<longrightarrow> ready_queues b x = ready_queues ba x; \<forall>asid. asid \<noteq> 0 \<and> pasASIDAbs aag asid \<in> subjectReads (pasPolicy aag) l \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))); asida \<noteq> 0; pasASIDAbs aag asida \<in> subjectReads (pasPolicy aag) l; asid_table ba (asid_high_bits_of asida) = Some pool_ptr\<rbrakk> \<Longrightarrow> \<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida) proof (prove)
goal (2 subgoals):
 1. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); aag_can_affect_label aag l; \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_states b x = interrupt_states ba x; \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x; \<forall>x. (\<exists>la\<in>pasDomainAbs aag x. la \<in> subjectReads (pasPolicy aag) l) \<longrightarrow> ready_queues b x = ready_queues ba x; asida \<noteq> 0; pasASIDAbs aag asida \<in> subjectReads (pasPolicy aag) l; asid_table ba (asid_high_bits_of asida) = Some pool_ptr; pool_ptr \<noteq> a; underlying_memory (machine_state s) asida = underlying_memory (machine_state b) asida; underlying_memory (machine_state t) asida = underlying_memory (machine_state ba) asida; device_state (machine_state s) asida = device_state (machine_state b) asida; device_state (machine_state t) asida = device_state (machine_state ba) asida; \<forall>ba. cdt s (asida, ba) = cdt b (asida, ba); \<forall>b. cdt t (asida, b) = cdt ba (asida, b); \<forall>ba. cdt_list s (asida, ba) = cdt_list b (asida, ba); \<forall>b. cdt_list t (asida, b) = cdt_list ba (asida, b); ekheap s asida = ekheap b asida; ekheap t asida = ekheap ba asida; \<forall>ba. is_original_cap s (asida, ba) = is_original_cap b (asida, ba); \<forall>b. is_original_cap t (asida, b) = is_original_cap ba (asida, b); asida \<noteq> a \<longrightarrow> kheap s asida = kheap b asida; asida \<noteq> a \<longrightarrow> kheap t asida = kheap ba asida; asida \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asida) = asid_table b (asid_high_bits_of asida) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asida) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida)))); asida \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asida) = asid_table ba (asid_high_bits_of asida) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asida) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida)))); pasObjectAbs aag asida \<in> subjectReads (pasPolicy aag) l \<longrightarrow> kheap s asida = kheap t asida; pasObjectAbs aag asida \<in> subjectReads (pasPolicy aag) l \<longrightarrow> underlying_memory (machine_state b) asida = underlying_memory (machine_state ba) asida; pasObjectAbs aag asida \<in> subjectReads (pasPolicy aag) l \<longrightarrow> device_state (machine_state b) asida = device_state (machine_state ba) asida; pasObjectAbs aag asida \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt b (asida, bb) = cdt ba (asida, bb)); pasObjectAbs aag asida \<in> subjectReads (pasPolicy aag) l \<longrightarrow> ekheap b asida = ekheap ba asida; pasObjectAbs aag asida \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt_list b (asida, bb) = cdt_list ba (asida, bb)); pasObjectAbs aag asida \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. is_original_cap b (asida, bb) = is_original_cap ba (asida, bb)); asida \<noteq> 0 \<and> pasASIDAbs aag asida \<in> subjectReads (pasPolicy aag) l \<longrightarrow> asid_table b (asid_high_bits_of asida) = asid_table ba (asid_high_bits_of asida) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asida) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida)))\<rbrakk> \<Longrightarrow> typ_at (AArch AASIDPool) pool_ptr b = typ_at (AArch AASIDPool) pool_ptr ba
 2. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_affect_label aag l; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> kheap s x = kheap t x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb)); \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> ekheap b x = ekheap ba x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb)); \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb)); \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_states b x = interrupt_states ba x; \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x; \<forall>x. (\<exists>la\<in>pasDomainAbs aag x. la \<in> subjectReads (pasPolicy aag) l) \<longrightarrow> ready_queues b x = ready_queues ba x; \<forall>asid. asid \<noteq> 0 \<and> pasASIDAbs aag asid \<in> subjectReads (pasPolicy aag) l \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))); asida \<noteq> 0; pasASIDAbs aag asida \<in> subjectReads (pasPolicy aag) l; asid_table ba (asid_high_bits_of asida) = Some pool_ptr\<rbrakk> \<Longrightarrow> \<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida) proof (prove)
goal (1 subgoal):
 1. \<And>s t b ba asida pool_ptr. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_affect_label aag l; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> kheap s x = kheap t x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb)); \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> ekheap b x = ekheap ba x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb)); \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb)); \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_states b x = interrupt_states ba x; \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x; \<forall>x. (\<exists>la\<in>pasDomainAbs aag x. la \<in> subjectReads (pasPolicy aag) l) \<longrightarrow> ready_queues b x = ready_queues ba x; \<forall>asid. asid \<noteq> 0 \<and> pasASIDAbs aag asid \<in> subjectReads (pasPolicy aag) l \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))); asida \<noteq> 0; pasASIDAbs aag asida \<in> subjectReads (pasPolicy aag) l; asid_table ba (asid_high_bits_of asida) = Some pool_ptr\<rbrakk> \<Longrightarrow> \<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida) proof (prove)
goal (1 subgoal):
 1. \<And>s t b ba asida pool_ptr asid_pool asid_pool'. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_affect_label aag l; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> kheap s x = kheap t x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb)); \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> ekheap b x = ekheap ba x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb)); \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb)); \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_states b x = interrupt_states ba x; \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x; \<forall>x. (\<exists>la\<in>pasDomainAbs aag x. la \<in> subjectReads (pasPolicy aag) l) \<longrightarrow> ready_queues b x = ready_queues ba x; \<forall>asid. asid \<noteq> 0 \<and> pasASIDAbs aag asid \<in> subjectReads (pasPolicy aag) l \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))); asida \<noteq> 0; pasASIDAbs aag asida \<in> subjectReads (pasPolicy aag) l; asid_table ba (asid_high_bits_of asida) = Some pool_ptr; kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)); kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool'))\<rbrakk> \<Longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida) proof (prove)
goal (2 subgoals):
 1. \<And>s t b ba asida pool_ptr asid_pool asid_pool'. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_affect_label aag l; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> kheap s x = kheap t x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb)); \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> ekheap b x = ekheap ba x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb)); \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb)); \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_states b x = interrupt_states ba x; \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x; \<forall>x. (\<exists>la\<in>pasDomainAbs aag x. la \<in> subjectReads (pasPolicy aag) l) \<longrightarrow> ready_queues b x = ready_queues ba x; \<forall>asid. asid \<noteq> 0 \<and> pasASIDAbs aag asid \<in> subjectReads (pasPolicy aag) l \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))); asida \<noteq> 0; pasASIDAbs aag asida \<in> subjectReads (pasPolicy aag) l; asid_table ba (asid_high_bits_of asida) = Some pool_ptr; kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)); kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')); pool_ptr = a\<rbrakk> \<Longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida)
 2. \<And>s t b ba asida pool_ptr asid_pool asid_pool'. \<lbrakk>((), b) \<in> fst (set_asid_pool a (pool(UCAST(32 \<rightarrow> 10) asid := None)) s); ((), ba) \<in> fst (set_asid_pool a (pool'(UCAST(32 \<rightarrow> 10) asid := None)) t); asid_table b (asid_high_bits_of asid) = Some a; kheap s a = Some (ArchObj (ASIDPool pool)); asid_table ba (asid_high_bits_of asid) = Some a; kheap t a = Some (ArchObj (ASIDPool pool')); asid \<noteq> 0; is_subject_asid aag asid; reads_equiv aag s t; \<forall>x. underlying_memory (machine_state s) x = underlying_memory (machine_state b) x; \<forall>x. underlying_memory (machine_state t) x = underlying_memory (machine_state ba) x; \<forall>x. device_state (machine_state s) x = device_state (machine_state b) x; \<forall>x. device_state (machine_state t) x = device_state (machine_state ba) x; \<forall>a ba. cdt s (a, ba) = cdt b (a, ba); \<forall>a b. cdt t (a, b) = cdt ba (a, b); \<forall>a ba. cdt_list s (a, ba) = cdt_list b (a, ba); \<forall>a b. cdt_list t (a, b) = cdt_list ba (a, b); \<forall>x. ekheap s x = ekheap b x; \<forall>x. ekheap t x = ekheap ba x; \<forall>x. ready_queues s x = ready_queues b x; \<forall>x. ready_queues t x = ready_queues ba x; \<forall>a ba. is_original_cap s (a, ba) = is_original_cap b (a, ba); \<forall>a b. is_original_cap t (a, b) = is_original_cap ba (a, b); \<forall>x. interrupt_states s x = interrupt_states b x; \<forall>x. interrupt_states t x = interrupt_states ba x; \<forall>x. interrupt_irq_node s x = interrupt_irq_node b x; \<forall>x. interrupt_irq_node t x = interrupt_irq_node ba x; cur_thread s = cur_thread b; cur_thread t = cur_thread ba; cur_domain s = cur_domain b; cur_domain t = cur_domain ba; scheduler_action s = scheduler_action b; scheduler_action t = scheduler_action ba; work_units_completed s = work_units_completed b; work_units_completed t = work_units_completed ba; equiv_irq_state (machine_state s) (machine_state b); equiv_irq_state (machine_state t) (machine_state ba); \<forall>p. p \<noteq> a \<longrightarrow> kheap s p = kheap b p; \<forall>p. p \<noteq> a \<longrightarrow> kheap t p = kheap ba p; kheap b a = Some (ArchObj (ASIDPool (pool(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table b (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr b \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); kheap ba a = Some (ArchObj (ASIDPool (pool'(UCAST(32 \<rightarrow> 10) asid := None)))); \<forall>asid. asid \<noteq> 0 \<longrightarrow> asid_table t (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table t (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr t = typ_at (AArch AASIDPool) pool_ptr ba \<and> (pool_ptr \<noteq> a \<longrightarrow> (\<forall>asid_pool asid_pool'. kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); aag_can_affect_label aag l; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> kheap s x = kheap t x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> underlying_memory (machine_state b) x = underlying_memory (machine_state ba) x; \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> device_state (machine_state b) x = device_state (machine_state ba) x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt b (a, bb) = cdt ba (a, bb)); \<forall>x. pasObjectAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> ekheap b x = ekheap ba x; \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. cdt_list b (a, bb) = cdt_list ba (a, bb)); \<forall>a. pasObjectAbs aag a \<in> subjectReads (pasPolicy aag) l \<longrightarrow> (\<forall>bb. is_original_cap b (a, bb) = is_original_cap ba (a, bb)); \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_states b x = interrupt_states ba x; \<forall>x. pasIRQAbs aag x \<in> subjectReads (pasPolicy aag) l \<longrightarrow> interrupt_irq_node b x = interrupt_irq_node ba x; \<forall>x. (\<exists>la\<in>pasDomainAbs aag x. la \<in> subjectReads (pasPolicy aag) l) \<longrightarrow> ready_queues b x = ready_queues ba x; \<forall>asid. asid \<noteq> 0 \<and> pasASIDAbs aag asid \<in> subjectReads (pasPolicy aag) l \<longrightarrow> asid_table b (asid_high_bits_of asid) = asid_table ba (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table b (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr t \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap t pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid))); asida \<noteq> 0; pasASIDAbs aag asida \<in> subjectReads (pasPolicy aag) l; asid_table ba (asid_high_bits_of asida) = Some pool_ptr; kheap b pool_ptr = Some (ArchObj (ASIDPool asid_pool)); kheap ba pool_ptr = Some (ArchObj (ASIDPool asid_pool')); pool_ptr \<noteq> a\<rbrakk> \<Longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asida) = asid_pool' (UCAST(32 \<rightarrow> 10) asida) proof (prove)
goal:
No subgoals!