theory VSpace_C

lemma performPageInvocationUnmap_ccorres:
  "ccorres (K (K \<bottom>) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_')
       (invs' and cte_wp_at' ((=) (ArchObjectCap cap) o cteCap) ctSlot and K (isPageCap cap))
       (UNIV \<inter> \<lbrace>ccap_relation (ArchObjectCap cap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>ctSlot = Ptr ctSlot\<rbrace>)
       []
       (liftE (performPageInvocation (PageUnmap cap ctSlot)))
       (Call performPageInvocationUnmap_'proc)" apply (simp only: liftE_liftM ccorres_liftM_simp) apply (cinit lift: cap_' ctSlot_') apply csymbr apply (rule ccorres_guard_imp [where A=
               "invs'
                and cte_wp_at' ((=) (ArchObjectCap cap) o cteCap) ctSlot
                and K (isPageCap cap)"]) apply wpc apply (rule_tac P=" ret__unsigned_long = 0" in ccorres_gen_asm) apply simp apply (rule ccorres_symb_exec_l) apply (rule ccorres_split_nothrow_novcg) apply (rule ccorres_Guard) apply (rule updateCap_frame_mapped_addr_ccorres) apply ceqv apply (rule_tac P=\<top> and P'=UNIV in ccorres_from_vcg_throws) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def) apply wp[1] apply (simp add: guard_is_UNIV_def) apply (wp getSlotCap_wp', simp) apply (wp getSlotCap_wp') apply simp apply (rule_tac P=" ret__unsigned_long \<noteq> 0" in ccorres_gen_asm) apply (simp cong: Guard_no_cong) apply (rule ccorres_rhs_assoc)+ apply (csymbr) apply csymbr apply csymbr apply csymbr apply wpc apply (ctac (no_vcg) add: unmapPage_ccorres) apply (rule ccorres_lhs_assoc) apply (rule ccorres_split_nothrow_novcg) apply (rule ccorres_move_Guard [where P="cte_at' ctSlot" and P'=\<top>]) apply (clarsimp simp: cte_wp_at_ctes_of) apply (drule (1) rf_sr_ctes_of_clift) apply (fastforce intro: typ_heap_simps) apply (rule ccorres_symb_exec_l) apply (rule updateCap_frame_mapped_addr_ccorres) apply (wp getSlotCap_wp', simp) apply (wp getSlotCap_wp') apply simp apply ceqv apply (rule_tac P=\<top> and P'=UNIV in ccorres_from_vcg_throws) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def) apply wp[1] apply (simp add: guard_is_UNIV_def) apply (simp add: cte_wp_at_ctes_of) apply wp apply (clarsimp simp: cte_wp_at_ctes_of isCap_simps split: if_split) apply (drule_tac t="cteCap cte" in sym) apply clarsimp apply (drule ccap_relation_mapped_asid_0) apply (frule ctes_of_valid', clarsimp) apply (drule valid_global_refsD_with_objSize, clarsimp) apply (fastforce simp: mask_def valid_cap'_def) apply assumption apply (clarsimp simp: cte_wp_at_ctes_of isCap_simps split: if_split) apply (drule_tac t="cteCap cte" in sym) apply clarsimp apply (frule (1) rf_sr_ctes_of_clift) apply (clarsimp simp: typ_heap_simps') apply (frule ccap_relation_PageCap_generics) apply (case_tac "v2 = ARMSmallPage") apply (auto simp add: cap_get_tag_isCap_ArchObject2 isCap_simps) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (K (K (\<lambda>_. False)) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) (UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap cap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>ctSlot = cte_Ptr ctSlot\<rbrace>) [] (liftE (performPageInvocation (ARM_H.PageUnmap cap ctSlot))) (Call performPageInvocationUnmap_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) (UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap cap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>ctSlot = cte_Ptr ctSlot\<rbrace>) [] (performPageInvocation (ARM_H.PageUnmap cap ctSlot)) (Call performPageInvocationUnmap_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>ctSlota capa. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q467 ctSlota capa) (?Q'467 ctSlota capa) [SKIP] (do y <- case capVPMappedAddress cap of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmapPage (capVPSize cap) asid vaddr (capVPBasePtr cap);
cap <- liftM capCap (getSlotCap ctSlot);
y <- updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od) (\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFIsMapped_'proc(capa);;
(IF \<acute>ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(capa);;
\<acute>unsigned_long_eret_2 :== CALL generic_frame_cap_get_capFMappedASID_'proc(capa);;
\<acute>unsigned_long_eret_3 :== CALL generic_frame_cap_get_capFMappedAddress_'proc(capa);;
\<acute>unsigned_long_eret_4 :== CALL generic_frame_cap_get_capFBasePtr_'proc(capa);;
CALL unmapPage_'proc(\<acute>ret__unsigned_long,\<acute>unsigned_long_eret_2,\<acute>unsigned_long_eret_3,PTR(unit) \<acute>unsigned_long_eret_4)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(ctSlota\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,SCAST(32 signed \<rightarrow> 32) 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q467 ctSlota capa s \<and> s' \<in> ?Q'467 ctSlota capa proof (prove)
goal (2 subgoals):
 1. \<And>ctSlota capa ret__unsigned_long. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q467 ctSlota capa) (?G'476 ctSlota capa ret__unsigned_long) [SKIP] (do y <- case capVPMappedAddress cap of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmapPage (capVPSize cap) asid vaddr (capVPBasePtr cap);
cap <- liftM capCap (getSlotCap ctSlot);
y <- updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od) (IF ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(capa);;
\<acute>unsigned_long_eret_2 :== CALL generic_frame_cap_get_capFMappedASID_'proc(capa);;
\<acute>unsigned_long_eret_3 :== CALL generic_frame_cap_get_capFMappedAddress_'proc(capa);;
\<acute>unsigned_long_eret_4 :== CALL generic_frame_cap_get_capFBasePtr_'proc(capa);;
CALL unmapPage_'proc(\<acute>ret__unsigned_long,\<acute>unsigned_long_eret_2,\<acute>unsigned_long_eret_3,PTR(unit) \<acute>unsigned_long_eret_4)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(ctSlota\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,SCAST(32 signed \<rightarrow> 32) 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q467 ctSlota capa s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (4 subgoals):
 1. \<And>ctSlota capa ret__unsigned_long. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q598 ctSlota capa ret__unsigned_long) (?Q'598 ctSlota capa ret__unsigned_long) [SKIP] (do y <- case capVPMappedAddress cap of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> unmapPage (capVPSize cap) asid vaddr (capVPBasePtr cap);
cap <- liftM capCap (getSlotCap ctSlot);
y <- updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od) (IF ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(capa);;
\<acute>unsigned_long_eret_2 :== CALL generic_frame_cap_get_capFMappedASID_'proc(capa);;
\<acute>unsigned_long_eret_3 :== CALL generic_frame_cap_get_capFMappedAddress_'proc(capa);;
\<acute>unsigned_long_eret_4 :== CALL generic_frame_cap_get_capFBasePtr_'proc(capa);;
CALL unmapPage_'proc(\<acute>ret__unsigned_long,\<acute>unsigned_long_eret_2,\<acute>unsigned_long_eret_3,PTR(unit) \<acute>unsigned_long_eret_4)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(ctSlota\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,SCAST(32 signed \<rightarrow> 32) 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> ?Q598 ctSlota capa ret__unsigned_long s
 3. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> ?Q'598 ctSlota capa ret__unsigned_long
 4. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (5 subgoals):
 1. \<And>ctSlota capa ret__unsigned_long. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); capVPMappedAddress cap = None\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?R610 ctSlota capa ret__unsigned_long) (?R''612 ctSlota capa ret__unsigned_long) [SKIP] (do y <- return ();
cap <- liftM capCap (getSlotCap ctSlot);
y <- updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od) (IF ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(capa);;
\<acute>unsigned_long_eret_2 :== CALL generic_frame_cap_get_capFMappedASID_'proc(capa);;
\<acute>unsigned_long_eret_3 :== CALL generic_frame_cap_get_capFMappedAddress_'proc(capa);;
\<acute>unsigned_long_eret_4 :== CALL generic_frame_cap_get_capFBasePtr_'proc(capa);;
CALL unmapPage_'proc(\<acute>ret__unsigned_long,\<acute>unsigned_long_eret_2,\<acute>unsigned_long_eret_3,PTR(unit) \<acute>unsigned_long_eret_4)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(ctSlota\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,SCAST(32 signed \<rightarrow> 32) 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>ctSlota capa ret__unsigned_long x2. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); capVPMappedAddress cap = Some x2\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?R611 ctSlota capa ret__unsigned_long x2) (?R''613 ctSlota capa ret__unsigned_long x2) [SKIP] (do y <- case x2 of (asid, vaddr) \<Rightarrow> unmapPage (capVPSize cap) asid vaddr (capVPBasePtr cap);
cap <- liftM capCap (getSlotCap ctSlot);
y <- updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od) (IF ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(capa);;
\<acute>unsigned_long_eret_2 :== CALL generic_frame_cap_get_capFMappedASID_'proc(capa);;
\<acute>unsigned_long_eret_3 :== CALL generic_frame_cap_get_capFMappedAddress_'proc(capa);;
\<acute>unsigned_long_eret_4 :== CALL generic_frame_cap_get_capFBasePtr_'proc(capa);;
CALL unmapPage_'proc(\<acute>ret__unsigned_long,\<acute>unsigned_long_eret_2,\<acute>unsigned_long_eret_3,PTR(unit) \<acute>unsigned_long_eret_4)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(ctSlota\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,SCAST(32 signed \<rightarrow> 32) 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 3. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> ?R610 ctSlota capa ret__unsigned_long s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ?R611 ctSlota capa ret__unsigned_long x s)
 4. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> ?R''612 ctSlota capa ret__unsigned_long} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> ?R''613 ctSlota capa ret__unsigned_long x}}
 5. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (5 subgoals):
 1. \<And>ctSlota capa ret__unsigned_long. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?G615 ctSlota capa ret__unsigned_long) (?R''612 ctSlota capa ret__unsigned_long) [SKIP] (do y <- return ();
cap <- liftM capCap (getSlotCap ctSlot);
y <- updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od) (IF ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(capa);;
\<acute>unsigned_long_eret_2 :== CALL generic_frame_cap_get_capFMappedASID_'proc(capa);;
\<acute>unsigned_long_eret_3 :== CALL generic_frame_cap_get_capFMappedAddress_'proc(capa);;
\<acute>unsigned_long_eret_4 :== CALL generic_frame_cap_get_capFBasePtr_'proc(capa);;
CALL unmapPage_'proc(\<acute>ret__unsigned_long,\<acute>unsigned_long_eret_2,\<acute>unsigned_long_eret_3,PTR(unit) \<acute>unsigned_long_eret_4)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(ctSlota\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,SCAST(32 signed \<rightarrow> 32) 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>ctSlota capa ret__unsigned_long x2. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); capVPMappedAddress cap = Some x2\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?R611 ctSlota capa ret__unsigned_long x2) (?R''613 ctSlota capa ret__unsigned_long x2) [SKIP] (do y <- case x2 of (asid, vaddr) \<Rightarrow> unmapPage (capVPSize cap) asid vaddr (capVPBasePtr cap);
cap <- liftM capCap (getSlotCap ctSlot);
y <- updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od) (IF ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(capa);;
\<acute>unsigned_long_eret_2 :== CALL generic_frame_cap_get_capFMappedASID_'proc(capa);;
\<acute>unsigned_long_eret_3 :== CALL generic_frame_cap_get_capFMappedAddress_'proc(capa);;
\<acute>unsigned_long_eret_4 :== CALL generic_frame_cap_get_capFBasePtr_'proc(capa);;
CALL unmapPage_'proc(\<acute>ret__unsigned_long,\<acute>unsigned_long_eret_2,\<acute>unsigned_long_eret_3,PTR(unit) \<acute>unsigned_long_eret_4)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(ctSlota\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,SCAST(32 signed \<rightarrow> 32) 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 3. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> (?G615 ctSlota capa ret__unsigned_long and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ?R611 ctSlota capa ret__unsigned_long x s)
 4. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> ?R''612 ctSlota capa ret__unsigned_long} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> ?R''613 ctSlota capa ret__unsigned_long x}}
 5. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (5 subgoals):
 1. \<And>ctSlota capa ret__unsigned_long. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?G615 (cte_Ptr ctSlot) capa 0) (?R''612 (cte_Ptr ctSlot) capa 0) [SKIP] (do cap <- liftM capCap (getSlotCap ctSlot);
y <- updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>ctSlota capa ret__unsigned_long x2. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); capVPMappedAddress cap = Some x2\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?R611 ctSlota capa ret__unsigned_long x2) (?R''613 ctSlota capa ret__unsigned_long x2) [SKIP] (do y <- case x2 of (asid, vaddr) \<Rightarrow> unmapPage (capVPSize cap) asid vaddr (capVPBasePtr cap);
cap <- liftM capCap (getSlotCap ctSlot);
y <- updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od) (IF ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(capa);;
\<acute>unsigned_long_eret_2 :== CALL generic_frame_cap_get_capFMappedASID_'proc(capa);;
\<acute>unsigned_long_eret_3 :== CALL generic_frame_cap_get_capFMappedAddress_'proc(capa);;
\<acute>unsigned_long_eret_4 :== CALL generic_frame_cap_get_capFBasePtr_'proc(capa);;
CALL unmapPage_'proc(\<acute>ret__unsigned_long,\<acute>unsigned_long_eret_2,\<acute>unsigned_long_eret_3,PTR(unit) \<acute>unsigned_long_eret_4)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(ctSlota\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,SCAST(32 signed \<rightarrow> 32) 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 3. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> (?G615 ctSlota capa ret__unsigned_long and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ?R611 ctSlota capa ret__unsigned_long x s)
 4. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> ?R''612 ctSlota capa ret__unsigned_long} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> ?R''613 ctSlota capa ret__unsigned_long x}}
 5. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (8 subgoals):
 1. \<And>ctSlota capa ret__unsigned_long capb. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q638 (cte_Ptr ctSlot) capa 0 capb) (?Q'636 (cte_Ptr ctSlot) capa 0 capb) [SKIP] (do y <- updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capb));
return []
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM capCap (getSlotCap ctSlot) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>ctSlota capa ret__unsigned_long. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> \<lbrace>?G615 (cte_Ptr ctSlot) capa 0\<rbrace> liftM capCap (getSlotCap ctSlot) \<lbrace>?Q638 (cte_Ptr ctSlot) capa 0\<rbrace>
 4. \<And>ctSlota capa ret__unsigned_long. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> empty_fail (liftM capCap (getSlotCap ctSlot))
 5. \<And>ctSlota capa ret__unsigned_long x2. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); capVPMappedAddress cap = Some x2\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?R611 ctSlota capa ret__unsigned_long x2) (?R''613 ctSlota capa ret__unsigned_long x2) [SKIP] (do y <- case x2 of (asid, vaddr) \<Rightarrow> unmapPage (capVPSize cap) asid vaddr (capVPBasePtr cap);
cap <- liftM capCap (getSlotCap ctSlot);
y <- updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od) (IF ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(capa);;
\<acute>unsigned_long_eret_2 :== CALL generic_frame_cap_get_capFMappedASID_'proc(capa);;
\<acute>unsigned_long_eret_3 :== CALL generic_frame_cap_get_capFMappedAddress_'proc(capa);;
\<acute>unsigned_long_eret_4 :== CALL generic_frame_cap_get_capFBasePtr_'proc(capa);;
CALL unmapPage_'proc(\<acute>ret__unsigned_long,\<acute>unsigned_long_eret_2,\<acute>unsigned_long_eret_3,PTR(unit) \<acute>unsigned_long_eret_4)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(ctSlota\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,SCAST(32 signed \<rightarrow> 32) 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 6. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> (?G615 ctSlota capa ret__unsigned_long and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ?R611 ctSlota capa ret__unsigned_long x s)
 7. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ?Q638 ctSlota capa ret__unsigned_long rv s \<longrightarrow> s' \<in> ?Q'636 ctSlota capa ret__unsigned_long rv}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> ?R''613 ctSlota capa ret__unsigned_long x}}
 8. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (12 subgoals):
 1. \<And>ctSlota capa ret__unsigned_long capb. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> ccorres (?r'644 ctSlota capa ret__unsigned_long capb) (?xf'644 ctSlota capa ret__unsigned_long capb) (?P650 (cte_Ptr ctSlot) capa 0 capb) (?Q'636 (cte_Ptr ctSlot) capa 0 capb) [] (updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capb))) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,0)))
 2. \<And>ctSlota capa ret__unsigned_long capb rv' t t'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'644 ctSlota capa ret__unsigned_long capb) rv' t t' (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'644 ctSlota capa ret__unsigned_long capb rv')
 3. \<And>ctSlota capa ret__unsigned_long capb rv rv'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0; ?r'644 ctSlota capa ret__unsigned_long capb rv rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q644 ctSlota capa ret__unsigned_long capb rv) (?Q'644 ctSlota capa ret__unsigned_long capb rv rv') [SKIP] (return []) (?d'644 ctSlota capa ret__unsigned_long capb rv')
 4. \<And>ctSlota capa ret__unsigned_long capb. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> \<lbrace>?R648 (cte_Ptr ctSlot) capa 0 capb\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capb)) \<lbrace>?Q644 ctSlota capa ret__unsigned_long capb\<rbrace>
 5. \<And>ctSlota capa ret__unsigned_long capb. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'644 ctSlota capa ret__unsigned_long capb) (?xf'644 ctSlota capa ret__unsigned_long capb) (?Q'644 ctSlota capa ret__unsigned_long capb)
 6. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM capCap (getSlotCap ctSlot) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>ctSlota capa ret__unsigned_long. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> \<lbrace>?G615 (cte_Ptr ctSlot) capa 0\<rbrace> liftM capCap (getSlotCap ctSlot) \<lbrace>\<lambda>a. ?P650 (cte_Ptr ctSlot) capa 0 a and ?R648 (cte_Ptr ctSlot) capa 0 a\<rbrace>
 8. \<And>ctSlota capa ret__unsigned_long. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> empty_fail (liftM capCap (getSlotCap ctSlot))
 9. \<And>ctSlota capa ret__unsigned_long x2. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); capVPMappedAddress cap = Some x2\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?R611 ctSlota capa ret__unsigned_long x2) (?R''613 ctSlota capa ret__unsigned_long x2) [SKIP] (do y <- case x2 of (asid, vaddr) \<Rightarrow> unmapPage (capVPSize cap) asid vaddr (capVPBasePtr cap);
cap <- liftM capCap (getSlotCap ctSlot);
y <- updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od) (IF ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(capa);;
\<acute>unsigned_long_eret_2 :== CALL generic_frame_cap_get_capFMappedASID_'proc(capa);;
\<acute>unsigned_long_eret_3 :== CALL generic_frame_cap_get_capFMappedAddress_'proc(capa);;
\<acute>unsigned_long_eret_4 :== CALL generic_frame_cap_get_capFBasePtr_'proc(capa);;
CALL unmapPage_'proc(\<acute>ret__unsigned_long,\<acute>unsigned_long_eret_2,\<acute>unsigned_long_eret_3,PTR(unit) \<acute>unsigned_long_eret_4)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(ctSlota\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,SCAST(32 signed \<rightarrow> 32) 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 10. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> (?G615 ctSlota capa ret__unsigned_long and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ?R611 ctSlota capa ret__unsigned_long x s)
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>ctSlota capa ret__unsigned_long capb. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> ccorres (?r'644 ctSlota capa ret__unsigned_long capb) (?xf'644 ctSlota capa ret__unsigned_long capb) (?P650 (cte_Ptr ctSlot) capa 0 capb) (?C'658 (cte_Ptr ctSlot) capa 0 capb) [] (updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capb))) (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,0))
 2. \<And>ctSlota capa ret__unsigned_long capb rv' t t'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'644 ctSlota capa ret__unsigned_long capb) rv' t t' (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'644 ctSlota capa ret__unsigned_long capb rv')
 3. \<And>ctSlota capa ret__unsigned_long capb rv rv'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0; ?r'644 ctSlota capa ret__unsigned_long capb rv rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q644 ctSlota capa ret__unsigned_long capb rv) (?Q'644 ctSlota capa ret__unsigned_long capb rv rv') [SKIP] (return []) (?d'644 ctSlota capa ret__unsigned_long capb rv')
 4. \<And>ctSlota capa ret__unsigned_long capb. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> \<lbrace>?R648 (cte_Ptr ctSlot) capa 0 capb\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capb)) \<lbrace>?Q644 ctSlota capa ret__unsigned_long capb\<rbrace>
 5. \<And>ctSlota capa ret__unsigned_long capb. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'644 ctSlota capa ret__unsigned_long capb) (?xf'644 ctSlota capa ret__unsigned_long capb) (?Q'644 ctSlota capa ret__unsigned_long capb)
 6. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM capCap (getSlotCap ctSlot) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>ctSlota capa ret__unsigned_long. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> \<lbrace>?G615 (cte_Ptr ctSlot) capa 0\<rbrace> liftM capCap (getSlotCap ctSlot) \<lbrace>\<lambda>a. ?P650 (cte_Ptr ctSlot) capa 0 a and ?R648 (cte_Ptr ctSlot) capa 0 a\<rbrace>
 8. \<And>ctSlota capa ret__unsigned_long. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> empty_fail (liftM capCap (getSlotCap ctSlot))
 9. \<And>ctSlota capa ret__unsigned_long x2. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); capVPMappedAddress cap = Some x2\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?R611 ctSlota capa ret__unsigned_long x2) (?R''613 ctSlota capa ret__unsigned_long x2) [SKIP] (do y <- case x2 of (asid, vaddr) \<Rightarrow> unmapPage (capVPSize cap) asid vaddr (capVPBasePtr cap);
cap <- liftM capCap (getSlotCap ctSlot);
y <- updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od) (IF ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(capa);;
\<acute>unsigned_long_eret_2 :== CALL generic_frame_cap_get_capFMappedASID_'proc(capa);;
\<acute>unsigned_long_eret_3 :== CALL generic_frame_cap_get_capFMappedAddress_'proc(capa);;
\<acute>unsigned_long_eret_4 :== CALL generic_frame_cap_get_capFBasePtr_'proc(capa);;
CALL unmapPage_'proc(\<acute>ret__unsigned_long,\<acute>unsigned_long_eret_2,\<acute>unsigned_long_eret_3,PTR(unit) \<acute>unsigned_long_eret_4)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(ctSlota\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,SCAST(32 signed \<rightarrow> 32) 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 10. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> (?G615 ctSlota capa ret__unsigned_long and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ?R611 ctSlota capa ret__unsigned_long x s)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>ctSlota capa ret__unsigned_long capb rv' t t'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'644 ctSlota capa ret__unsigned_long capb rv')
 2. \<And>ctSlota capa ret__unsigned_long capb rv rv'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q644 ctSlota capa ret__unsigned_long capb rv) (?Q'644 ctSlota capa ret__unsigned_long capb rv rv') [SKIP] (return []) (?d'644 ctSlota capa ret__unsigned_long capb rv')
 3. \<And>ctSlota capa ret__unsigned_long capb. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> \<lbrace>?R648 (cte_Ptr ctSlot) capa 0 capb\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capb)) \<lbrace>?Q644 ctSlota capa ret__unsigned_long capb\<rbrace>
 4. \<And>ctSlota capa ret__unsigned_long capb. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'644 ctSlota capa ret__unsigned_long capb)
 5. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM capCap (getSlotCap ctSlot) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>ctSlota capa ret__unsigned_long. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> \<lbrace>?G615 (cte_Ptr ctSlot) capa 0\<rbrace> liftM capCap (getSlotCap ctSlot) \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>c. capability.ArchObjectCap a = cteCap c) ctSlot and K (isPageCap a) and ?R648 (cte_Ptr ctSlot) capa 0 a\<rbrace>
 7. \<And>ctSlota capa ret__unsigned_long. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> empty_fail (liftM capCap (getSlotCap ctSlot))
 8. \<And>ctSlota capa ret__unsigned_long x2. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); capVPMappedAddress cap = Some x2\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?R611 ctSlota capa ret__unsigned_long x2) (?R''613 ctSlota capa ret__unsigned_long x2) [SKIP] (do y <- case x2 of (asid, vaddr) \<Rightarrow> unmapPage (capVPSize cap) asid vaddr (capVPBasePtr cap);
cap <- liftM capCap (getSlotCap ctSlot);
y <- updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od) (IF ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(capa);;
\<acute>unsigned_long_eret_2 :== CALL generic_frame_cap_get_capFMappedASID_'proc(capa);;
\<acute>unsigned_long_eret_3 :== CALL generic_frame_cap_get_capFMappedAddress_'proc(capa);;
\<acute>unsigned_long_eret_4 :== CALL generic_frame_cap_get_capFBasePtr_'proc(capa);;
CALL unmapPage_'proc(\<acute>ret__unsigned_long,\<acute>unsigned_long_eret_2,\<acute>unsigned_long_eret_3,PTR(unit) \<acute>unsigned_long_eret_4)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(ctSlota\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,SCAST(32 signed \<rightarrow> 32) 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 9. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> (?G615 ctSlota capa ret__unsigned_long and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ?R611 ctSlota capa ret__unsigned_long x s)
 10. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and ?R648 ctSlota capa ret__unsigned_long rv) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> ?R''613 ctSlota capa ret__unsigned_long x}}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>ctSlota capa ret__unsigned_long capb rv rv'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q644 ctSlota capa ret__unsigned_long capb rv) (?Q'644 ctSlota capa ret__unsigned_long capb rv rv') [SKIP] (return []) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>ctSlota capa ret__unsigned_long capb. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> \<lbrace>?R648 (cte_Ptr ctSlot) capa 0 capb\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capb)) \<lbrace>?Q644 ctSlota capa ret__unsigned_long capb\<rbrace>
 3. \<And>ctSlota capa ret__unsigned_long capb. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'644 ctSlota capa ret__unsigned_long capb)
 4. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM capCap (getSlotCap ctSlot) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>ctSlota capa ret__unsigned_long. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> \<lbrace>?G615 (cte_Ptr ctSlot) capa 0\<rbrace> liftM capCap (getSlotCap ctSlot) \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>c. capability.ArchObjectCap a = cteCap c) ctSlot and K (isPageCap a) and ?R648 (cte_Ptr ctSlot) capa 0 a\<rbrace>
 6. \<And>ctSlota capa ret__unsigned_long. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> empty_fail (liftM capCap (getSlotCap ctSlot))
 7. \<And>ctSlota capa ret__unsigned_long x2. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); capVPMappedAddress cap = Some x2\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?R611 ctSlota capa ret__unsigned_long x2) (?R''613 ctSlota capa ret__unsigned_long x2) [SKIP] (do y <- case x2 of (asid, vaddr) \<Rightarrow> unmapPage (capVPSize cap) asid vaddr (capVPBasePtr cap);
cap <- liftM capCap (getSlotCap ctSlot);
y <- updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od) (IF ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(capa);;
\<acute>unsigned_long_eret_2 :== CALL generic_frame_cap_get_capFMappedASID_'proc(capa);;
\<acute>unsigned_long_eret_3 :== CALL generic_frame_cap_get_capFMappedAddress_'proc(capa);;
\<acute>unsigned_long_eret_4 :== CALL generic_frame_cap_get_capFBasePtr_'proc(capa);;
CALL unmapPage_'proc(\<acute>ret__unsigned_long,\<acute>unsigned_long_eret_2,\<acute>unsigned_long_eret_3,PTR(unit) \<acute>unsigned_long_eret_4)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(ctSlota\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,SCAST(32 signed \<rightarrow> 32) 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 8. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> (?G615 ctSlota capa ret__unsigned_long and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ?R611 ctSlota capa ret__unsigned_long x s)
 9. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and ?R648 ctSlota capa ret__unsigned_long rv) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> ?R''613 ctSlota capa ret__unsigned_long x}}
 10. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (10 subgoals):
 1. \<And>ctSlota capa ret__unsigned_long capb rv rv'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0; dc rv rv'\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return [] \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>ctSlota capa ret__unsigned_long capb. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> \<lbrace>?R648 (cte_Ptr ctSlot) capa 0 capb\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capb)) \<lbrace>\<lambda>rv _. True\<rbrace>
 3. \<And>ctSlota capa ret__unsigned_long capb. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'. UNIV)
 4. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM capCap (getSlotCap ctSlot) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>ctSlota capa ret__unsigned_long. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> \<lbrace>?G615 (cte_Ptr ctSlot) capa 0\<rbrace> liftM capCap (getSlotCap ctSlot) \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>c. capability.ArchObjectCap a = cteCap c) ctSlot and K (isPageCap a) and ?R648 (cte_Ptr ctSlot) capa 0 a\<rbrace>
 6. \<And>ctSlota capa ret__unsigned_long. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> empty_fail (liftM capCap (getSlotCap ctSlot))
 7. \<And>ctSlota capa ret__unsigned_long x2. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); capVPMappedAddress cap = Some x2\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?R611 ctSlota capa ret__unsigned_long x2) (?R''613 ctSlota capa ret__unsigned_long x2) [SKIP] (do y <- case x2 of (asid, vaddr) \<Rightarrow> unmapPage (capVPSize cap) asid vaddr (capVPBasePtr cap);
cap <- liftM capCap (getSlotCap ctSlot);
y <- updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od) (IF ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(capa);;
\<acute>unsigned_long_eret_2 :== CALL generic_frame_cap_get_capFMappedASID_'proc(capa);;
\<acute>unsigned_long_eret_3 :== CALL generic_frame_cap_get_capFMappedAddress_'proc(capa);;
\<acute>unsigned_long_eret_4 :== CALL generic_frame_cap_get_capFBasePtr_'proc(capa);;
CALL unmapPage_'proc(\<acute>ret__unsigned_long,\<acute>unsigned_long_eret_2,\<acute>unsigned_long_eret_3,PTR(unit) \<acute>unsigned_long_eret_4)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(ctSlota\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,SCAST(32 signed \<rightarrow> 32) 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 8. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> (?G615 ctSlota capa ret__unsigned_long and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ?R611 ctSlota capa ret__unsigned_long x s)
 9. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and ?R648 ctSlota capa ret__unsigned_long rv) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> ?R''613 ctSlota capa ret__unsigned_long x}}
 10. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (10 subgoals):
 1. \<And>ctSlota capa ret__unsigned_long capb rv rv' \<sigma>. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0; dc rv rv'\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return [] \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (K (K (\<lambda>_. False)) \<currency> dc) (Inr rv) (liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>))}
 2. \<And>ctSlota capa ret__unsigned_long capb. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> \<lbrace>?R648 (cte_Ptr ctSlot) capa 0 capb\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capb)) \<lbrace>\<lambda>rv _. True\<rbrace>
 3. \<And>ctSlota capa ret__unsigned_long capb. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'. UNIV)
 4. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM capCap (getSlotCap ctSlot) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>ctSlota capa ret__unsigned_long. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> \<lbrace>?G615 (cte_Ptr ctSlot) capa 0\<rbrace> liftM capCap (getSlotCap ctSlot) \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>c. capability.ArchObjectCap a = cteCap c) ctSlot and K (isPageCap a) and ?R648 (cte_Ptr ctSlot) capa 0 a\<rbrace>
 6. \<And>ctSlota capa ret__unsigned_long. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> empty_fail (liftM capCap (getSlotCap ctSlot))
 7. \<And>ctSlota capa ret__unsigned_long x2. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); capVPMappedAddress cap = Some x2\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?R611 ctSlota capa ret__unsigned_long x2) (?R''613 ctSlota capa ret__unsigned_long x2) [SKIP] (do y <- case x2 of (asid, vaddr) \<Rightarrow> unmapPage (capVPSize cap) asid vaddr (capVPBasePtr cap);
cap <- liftM capCap (getSlotCap ctSlot);
y <- updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od) (IF ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(capa);;
\<acute>unsigned_long_eret_2 :== CALL generic_frame_cap_get_capFMappedASID_'proc(capa);;
\<acute>unsigned_long_eret_3 :== CALL generic_frame_cap_get_capFMappedAddress_'proc(capa);;
\<acute>unsigned_long_eret_4 :== CALL generic_frame_cap_get_capFBasePtr_'proc(capa);;
CALL unmapPage_'proc(\<acute>ret__unsigned_long,\<acute>unsigned_long_eret_2,\<acute>unsigned_long_eret_3,PTR(unit) \<acute>unsigned_long_eret_4)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(ctSlota\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,SCAST(32 signed \<rightarrow> 32) 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 8. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> (?G615 ctSlota capa ret__unsigned_long and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ?R611 ctSlota capa ret__unsigned_long x s)
 9. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and ?R648 ctSlota capa ret__unsigned_long rv) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> ?R''613 ctSlota capa ret__unsigned_long x}}
 10. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (9 subgoals):
 1. \<And>ctSlota capa ret__unsigned_long capb. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> \<lbrace>?R648 (cte_Ptr ctSlot) capa 0 capb\<rbrace> updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) capb)) \<lbrace>\<lambda>rv _. True\<rbrace>
 2. \<And>ctSlota capa ret__unsigned_long capb. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'. UNIV)
 3. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM capCap (getSlotCap ctSlot) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>ctSlota capa ret__unsigned_long. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> \<lbrace>?G615 (cte_Ptr ctSlot) capa 0\<rbrace> liftM capCap (getSlotCap ctSlot) \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>c. capability.ArchObjectCap a = cteCap c) ctSlot and K (isPageCap a) and ?R648 (cte_Ptr ctSlot) capa 0 a\<rbrace>
 5. \<And>ctSlota capa ret__unsigned_long. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> empty_fail (liftM capCap (getSlotCap ctSlot))
 6. \<And>ctSlota capa ret__unsigned_long x2. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); capVPMappedAddress cap = Some x2\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?R611 ctSlota capa ret__unsigned_long x2) (?R''613 ctSlota capa ret__unsigned_long x2) [SKIP] (do y <- case x2 of (asid, vaddr) \<Rightarrow> unmapPage (capVPSize cap) asid vaddr (capVPBasePtr cap);
cap <- liftM capCap (getSlotCap ctSlot);
y <- updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od) (IF ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(capa);;
\<acute>unsigned_long_eret_2 :== CALL generic_frame_cap_get_capFMappedASID_'proc(capa);;
\<acute>unsigned_long_eret_3 :== CALL generic_frame_cap_get_capFMappedAddress_'proc(capa);;
\<acute>unsigned_long_eret_4 :== CALL generic_frame_cap_get_capFBasePtr_'proc(capa);;
CALL unmapPage_'proc(\<acute>ret__unsigned_long,\<acute>unsigned_long_eret_2,\<acute>unsigned_long_eret_3,PTR(unit) \<acute>unsigned_long_eret_4)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(ctSlota\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,SCAST(32 signed \<rightarrow> 32) 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 7. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> (?G615 ctSlota capa ret__unsigned_long and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ?R611 ctSlota capa ret__unsigned_long x s)
 8. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and ?R648 ctSlota capa ret__unsigned_long rv) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> ?R''613 ctSlota capa ret__unsigned_long x}}
 9. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (8 subgoals):
 1. \<And>ctSlota capa ret__unsigned_long capb. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'. UNIV)
 2. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM capCap (getSlotCap ctSlot) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>ctSlota capa ret__unsigned_long. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> \<lbrace>?G615 (cte_Ptr ctSlot) capa 0\<rbrace> liftM capCap (getSlotCap ctSlot) \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>c. capability.ArchObjectCap a = cteCap c) ctSlot and K (isPageCap a) and (\<lambda>a. True)\<rbrace>
 4. \<And>ctSlota capa ret__unsigned_long. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> empty_fail (liftM capCap (getSlotCap ctSlot))
 5. \<And>ctSlota capa ret__unsigned_long x2. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); capVPMappedAddress cap = Some x2\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?R611 ctSlota capa ret__unsigned_long x2) (?R''613 ctSlota capa ret__unsigned_long x2) [SKIP] (do y <- case x2 of (asid, vaddr) \<Rightarrow> unmapPage (capVPSize cap) asid vaddr (capVPBasePtr cap);
cap <- liftM capCap (getSlotCap ctSlot);
y <- updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od) (IF ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(capa);;
\<acute>unsigned_long_eret_2 :== CALL generic_frame_cap_get_capFMappedASID_'proc(capa);;
\<acute>unsigned_long_eret_3 :== CALL generic_frame_cap_get_capFMappedAddress_'proc(capa);;
\<acute>unsigned_long_eret_4 :== CALL generic_frame_cap_get_capFBasePtr_'proc(capa);;
CALL unmapPage_'proc(\<acute>ret__unsigned_long,\<acute>unsigned_long_eret_2,\<acute>unsigned_long_eret_3,PTR(unit) \<acute>unsigned_long_eret_4)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(ctSlota\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,SCAST(32 signed \<rightarrow> 32) 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 6. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> (?G615 ctSlota capa ret__unsigned_long and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ?R611 ctSlota capa ret__unsigned_long x s)
 7. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> ?R''613 ctSlota capa ret__unsigned_long x}}
 8. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (7 subgoals):
 1. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM capCap (getSlotCap ctSlot) \<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<And>ctSlota capa ret__unsigned_long. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> \<lbrace>?G615 (cte_Ptr ctSlot) capa 0\<rbrace> liftM capCap (getSlotCap ctSlot) \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>c. capability.ArchObjectCap a = cteCap c) ctSlot and K (isPageCap a) and (\<lambda>a. True)\<rbrace>
 3. \<And>ctSlota capa ret__unsigned_long. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> empty_fail (liftM capCap (getSlotCap ctSlot))
 4. \<And>ctSlota capa ret__unsigned_long x2. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); capVPMappedAddress cap = Some x2\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?R611 ctSlota capa ret__unsigned_long x2) (?R''613 ctSlota capa ret__unsigned_long x2) [SKIP] (do y <- case x2 of (asid, vaddr) \<Rightarrow> unmapPage (capVPSize cap) asid vaddr (capVPBasePtr cap);
cap <- liftM capCap (getSlotCap ctSlot);
y <- updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od) (IF ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(capa);;
\<acute>unsigned_long_eret_2 :== CALL generic_frame_cap_get_capFMappedASID_'proc(capa);;
\<acute>unsigned_long_eret_3 :== CALL generic_frame_cap_get_capFMappedAddress_'proc(capa);;
\<acute>unsigned_long_eret_4 :== CALL generic_frame_cap_get_capFBasePtr_'proc(capa);;
CALL unmapPage_'proc(\<acute>ret__unsigned_long,\<acute>unsigned_long_eret_2,\<acute>unsigned_long_eret_3,PTR(unit) \<acute>unsigned_long_eret_4)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(ctSlota\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,SCAST(32 signed \<rightarrow> 32) 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 5. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> (?G615 ctSlota capa ret__unsigned_long and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ?R611 ctSlota capa ret__unsigned_long x s)
 6. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> ?R''613 ctSlota capa ret__unsigned_long x}}
 7. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (6 subgoals):
 1. \<And>ctSlota capa ret__unsigned_long. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> \<lbrace>?G615 (cte_Ptr ctSlot) capa 0\<rbrace> liftM capCap (getSlotCap ctSlot) \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>c. capability.ArchObjectCap a = cteCap c) ctSlot and K (isPageCap a) and (\<lambda>a. True)\<rbrace>
 2. \<And>ctSlota capa ret__unsigned_long. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> empty_fail (liftM capCap (getSlotCap ctSlot))
 3. \<And>ctSlota capa ret__unsigned_long x2. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); capVPMappedAddress cap = Some x2\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?R611 ctSlota capa ret__unsigned_long x2) (?R''613 ctSlota capa ret__unsigned_long x2) [SKIP] (do y <- case x2 of (asid, vaddr) \<Rightarrow> unmapPage (capVPSize cap) asid vaddr (capVPBasePtr cap);
cap <- liftM capCap (getSlotCap ctSlot);
y <- updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od) (IF ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(capa);;
\<acute>unsigned_long_eret_2 :== CALL generic_frame_cap_get_capFMappedASID_'proc(capa);;
\<acute>unsigned_long_eret_3 :== CALL generic_frame_cap_get_capFMappedAddress_'proc(capa);;
\<acute>unsigned_long_eret_4 :== CALL generic_frame_cap_get_capFBasePtr_'proc(capa);;
CALL unmapPage_'proc(\<acute>ret__unsigned_long,\<acute>unsigned_long_eret_2,\<acute>unsigned_long_eret_3,PTR(unit) \<acute>unsigned_long_eret_4)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(ctSlota\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,SCAST(32 signed \<rightarrow> 32) 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 4. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> (?G615 ctSlota capa ret__unsigned_long and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ?R611 ctSlota capa ret__unsigned_long x s)
 5. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> ?R''613 ctSlota capa ret__unsigned_long x}}
 6. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (5 subgoals):
 1. \<And>ctSlota capa ret__unsigned_long. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0; capVPMappedAddress cap = None; ret__unsigned_long = 0\<rbrakk> \<Longrightarrow> empty_fail (liftM capCap (getSlotCap ctSlot))
 2. \<And>ctSlota capa ret__unsigned_long x2. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); capVPMappedAddress cap = Some x2\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?R611 ctSlota capa ret__unsigned_long x2) (?R''613 ctSlota capa ret__unsigned_long x2) [SKIP] (do y <- case x2 of (asid, vaddr) \<Rightarrow> unmapPage (capVPSize cap) asid vaddr (capVPBasePtr cap);
cap <- liftM capCap (getSlotCap ctSlot);
y <- updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od) (IF ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(capa);;
\<acute>unsigned_long_eret_2 :== CALL generic_frame_cap_get_capFMappedASID_'proc(capa);;
\<acute>unsigned_long_eret_3 :== CALL generic_frame_cap_get_capFMappedAddress_'proc(capa);;
\<acute>unsigned_long_eret_4 :== CALL generic_frame_cap_get_capFBasePtr_'proc(capa);;
CALL unmapPage_'proc(\<acute>ret__unsigned_long,\<acute>unsigned_long_eret_2,\<acute>unsigned_long_eret_3,PTR(unit) \<acute>unsigned_long_eret_4)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(ctSlota\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,SCAST(32 signed \<rightarrow> 32) 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 3. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> ((\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s \<and> True) \<circ> capCap) cap a) and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ?R611 ctSlota capa ret__unsigned_long x s)
 4. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> ?R''613 ctSlota capa ret__unsigned_long x}}
 5. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (4 subgoals):
 1. \<And>ctSlota capa ret__unsigned_long x2. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); capVPMappedAddress cap = Some x2\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?R611 ctSlota capa ret__unsigned_long x2) (?R''613 ctSlota capa ret__unsigned_long x2) [SKIP] (do y <- case x2 of (asid, vaddr) \<Rightarrow> unmapPage (capVPSize cap) asid vaddr (capVPBasePtr cap);
cap <- liftM capCap (getSlotCap ctSlot);
y <- updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od) (IF ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(capa);;
\<acute>unsigned_long_eret_2 :== CALL generic_frame_cap_get_capFMappedASID_'proc(capa);;
\<acute>unsigned_long_eret_3 :== CALL generic_frame_cap_get_capFMappedAddress_'proc(capa);;
\<acute>unsigned_long_eret_4 :== CALL generic_frame_cap_get_capFBasePtr_'proc(capa);;
CALL unmapPage_'proc(\<acute>ret__unsigned_long,\<acute>unsigned_long_eret_2,\<acute>unsigned_long_eret_3,PTR(unit) \<acute>unsigned_long_eret_4)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(ctSlota\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,SCAST(32 signed \<rightarrow> 32) 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> ((\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s \<and> True) \<circ> capCap) cap a) and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ?R611 ctSlota capa ret__unsigned_long x s)
 3. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> ?R''613 ctSlota capa ret__unsigned_long x}}
 4. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (4 subgoals):
 1. \<And>ctSlota capa ret__unsigned_long x2. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); capVPMappedAddress cap = Some x2; ret__unsigned_long \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?G700 ctSlota capa ret__unsigned_long x2) (?R''613 ctSlota capa ret__unsigned_long x2) [SKIP] (do y <- case x2 of (asid, vaddr) \<Rightarrow> unmapPage (capVPSize cap) asid vaddr (capVPBasePtr cap);
cap <- liftM capCap (getSlotCap ctSlot);
y <- updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od) (IF ret__unsigned_long \<noteq> 0 THEN
  \<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(capa);;
\<acute>unsigned_long_eret_2 :== CALL generic_frame_cap_get_capFMappedASID_'proc(capa);;
\<acute>unsigned_long_eret_3 :== CALL generic_frame_cap_get_capFMappedAddress_'proc(capa);;
\<acute>unsigned_long_eret_4 :== CALL generic_frame_cap_get_capFBasePtr_'proc(capa);;
CALL unmapPage_'proc(\<acute>ret__unsigned_long,\<acute>unsigned_long_eret_2,\<acute>unsigned_long_eret_3,PTR(unit) \<acute>unsigned_long_eret_4)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(ctSlota\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,SCAST(32 signed \<rightarrow> 32) 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> ((\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s \<and> True) \<circ> capCap) cap a) and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> (?G700 ctSlota capa ret__unsigned_long x and (\<lambda>_. ret__unsigned_long \<noteq> 0)) s)
 3. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> ?R''613 ctSlota capa ret__unsigned_long x}}
 4. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (4 subgoals):
 1. \<And>ctSlota capa ret__unsigned_long x2. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?G700 (cte_Ptr ctSlot) capa 1 x2) (?R''613 (cte_Ptr ctSlot) capa 1 x2) [SKIP] (do y <- case x2 of (asid, vaddr) \<Rightarrow> unmapPage (capVPSize cap) asid vaddr (capVPBasePtr cap);
cap <- liftM capCap (getSlotCap ctSlot);
y <- updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od) (\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(capa);;
\<acute>unsigned_long_eret_2 :== CALL generic_frame_cap_get_capFMappedASID_'proc(capa);;
\<acute>unsigned_long_eret_3 :== CALL generic_frame_cap_get_capFMappedAddress_'proc(capa);;
\<acute>unsigned_long_eret_4 :== CALL generic_frame_cap_get_capFBasePtr_'proc(capa);;
CALL unmapPage_'proc(\<acute>ret__unsigned_long,\<acute>unsigned_long_eret_2,\<acute>unsigned_long_eret_3,PTR(unit) \<acute>unsigned_long_eret_4);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> ((\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s \<and> True) \<circ> capCap) cap a) and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> (?G700 ctSlota capa ret__unsigned_long x and (\<lambda>_. ret__unsigned_long \<noteq> 0)) s)
 3. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> ?R''613 ctSlota capa ret__unsigned_long x}}
 4. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (4 subgoals):
 1. \<And>ctSlota capa ret__unsigned_long x2. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?G700 (cte_Ptr ctSlot) capa 1 x2) (?R''613 (cte_Ptr ctSlot) capa 1 x2) [SKIP] (do y <- case x2 of (asid, vaddr) \<Rightarrow> unmapPage (capVPSize cap) asid vaddr (capVPBasePtr cap);
cap <- liftM capCap (getSlotCap ctSlot);
y <- updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od) (\<acute>ret__unsigned_long :== CALL generic_frame_cap_get_capFSize_'proc(capa);;
(\<acute>unsigned_long_eret_2 :== CALL generic_frame_cap_get_capFMappedASID_'proc(capa);;
(\<acute>unsigned_long_eret_3 :== CALL generic_frame_cap_get_capFMappedAddress_'proc(capa);;
(\<acute>unsigned_long_eret_4 :== CALL generic_frame_cap_get_capFBasePtr_'proc(capa);;
(CALL unmapPage_'proc(\<acute>ret__unsigned_long,\<acute>unsigned_long_eret_2,\<acute>unsigned_long_eret_3,PTR(unit) \<acute>unsigned_long_eret_4);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> ((\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s \<and> True) \<circ> capCap) cap a) and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> (?G700 ctSlota capa ret__unsigned_long x and (\<lambda>_. ret__unsigned_long \<noteq> 0)) s)
 3. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> ?R''613 ctSlota capa ret__unsigned_long x}}
 4. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (4 subgoals):
 1. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?G700 (cte_Ptr ctSlot) capa 1 x2) (?G'739 (cte_Ptr ctSlot) capa 1 x2 ret__unsigned_long) [SKIP] (do y <- case x2 of (asid, vaddr) \<Rightarrow> unmapPage (capVPSize cap) asid vaddr (capVPBasePtr cap);
cap <- liftM capCap (getSlotCap ctSlot);
y <- updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od) (\<acute>unsigned_long_eret_2 :== CALL generic_frame_cap_get_capFMappedASID_'proc(capa);;
(\<acute>unsigned_long_eret_3 :== CALL generic_frame_cap_get_capFMappedAddress_'proc(capa);;
(\<acute>unsigned_long_eret_4 :== CALL generic_frame_cap_get_capFBasePtr_'proc(capa);;
(CALL unmapPage_'proc(ret__unsigned_long,\<acute>unsigned_long_eret_2,\<acute>unsigned_long_eret_3,PTR(unit) \<acute>unsigned_long_eret_4);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> ((\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s \<and> True) \<circ> capCap) cap a) and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> (?G700 ctSlota capa ret__unsigned_long x and (\<lambda>_. ret__unsigned_long \<noteq> 0)) s)
 3. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'739 ctSlota capa ret__unsigned_long x v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}}
 4. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (4 subgoals):
 1. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?G700 (cte_Ptr ctSlot) capa 1 x2) (?G'927 (cte_Ptr ctSlot) capa 1 x2 ret__unsigned_long unsigned_long_eret_2) [SKIP] (do y <- case x2 of (asid, vaddr) \<Rightarrow> unmapPage (capVPSize cap) asid vaddr (capVPBasePtr cap);
cap <- liftM capCap (getSlotCap ctSlot);
y <- updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od) (\<acute>unsigned_long_eret_3 :== CALL generic_frame_cap_get_capFMappedAddress_'proc(capa);;
(\<acute>unsigned_long_eret_4 :== CALL generic_frame_cap_get_capFBasePtr_'proc(capa);;
(CALL unmapPage_'proc(ret__unsigned_long,unsigned_long_eret_2,\<acute>unsigned_long_eret_3,PTR(unit) \<acute>unsigned_long_eret_4);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> ((\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s \<and> True) \<circ> capCap) cap a) and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> (?G700 ctSlota capa ret__unsigned_long x and (\<lambda>_. ret__unsigned_long \<noteq> 0)) s)
 3. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> ?G'927 ctSlota capa ret__unsigned_long x v va}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}}
 4. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (4 subgoals):
 1. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?G700 (cte_Ptr ctSlot) capa 1 x2) (?G'1086 (cte_Ptr ctSlot) capa 1 x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3) [SKIP] (do y <- case x2 of (asid, vaddr) \<Rightarrow> unmapPage (capVPSize cap) asid vaddr (capVPBasePtr cap);
cap <- liftM capCap (getSlotCap ctSlot);
y <- updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od) (\<acute>unsigned_long_eret_4 :== CALL generic_frame_cap_get_capFBasePtr_'proc(capa);;
(CALL unmapPage_'proc(ret__unsigned_long,unsigned_long_eret_2,unsigned_long_eret_3,PTR(unit) \<acute>unsigned_long_eret_4);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> ((\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s \<and> True) \<circ> capCap) cap a) and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> (?G700 ctSlota capa ret__unsigned_long x and (\<lambda>_. ret__unsigned_long \<noteq> 0)) s)
 3. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = generic_frame_cap_get_capFMappedAddress_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_3_' := vb\<rparr> \<in> {s. s \<in> ?G'1086 ctSlota capa ret__unsigned_long x v va vb}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}}
 4. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (4 subgoals):
 1. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?G700 (cte_Ptr ctSlot) capa 1 x2) (?G'1220 (cte_Ptr ctSlot) capa 1 x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4) [SKIP] (do y <- case x2 of (asid, vaddr) \<Rightarrow> unmapPage (capVPSize cap) asid vaddr (capVPBasePtr cap);
cap <- liftM capCap (getSlotCap ctSlot);
y <- updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od) (CALL unmapPage_'proc(ret__unsigned_long,unsigned_long_eret_2,unsigned_long_eret_3,PTR(unit) unsigned_long_eret_4);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> ((\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s \<and> True) \<circ> capCap) cap a) and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> (?G700 ctSlota capa ret__unsigned_long x and (\<lambda>_. ret__unsigned_long \<noteq> 0)) s)
 3. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = generic_frame_cap_get_capFMappedAddress_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_4_' := vc\<rparr> \<in> {s. s \<in> ?G'1220 ctSlota capa ret__unsigned_long x v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}}
 4. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (4 subgoals):
 1. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?R1328 (cte_Ptr ctSlot) capa 1 x2 a x1 x2a) (?R''1329 (cte_Ptr ctSlot) capa 1 x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a) [SKIP] (do a <- unmapPage (capVPSize cap) x1 x2a (capVPBasePtr cap);
cap <- liftM capCap (getSlotCap ctSlot);
y <- updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od) (CALL unmapPage_'proc(ret__unsigned_long,unsigned_long_eret_2,unsigned_long_eret_3,PTR(unit) unsigned_long_eret_4);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> ((\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s \<and> True) \<circ> capCap) cap a) and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ((\<lambda>a. \<forall>xa xb. x = (xa, xb) \<longrightarrow> ?R1328 ctSlota capa ret__unsigned_long x a xa xb) and (\<lambda>_. ret__unsigned_long \<noteq> 0)) s)
 3. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = generic_frame_cap_get_capFMappedAddress_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_4_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = (xa, xb) \<longrightarrow> s \<in> ?R''1329 ctSlota capa ret__unsigned_long x v va vb vc xa xb}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}}
 4. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (5 subgoals):
 1. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1337 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv) (?Q'1351 capa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) [SKIP] (do cap <- liftM capCap (getSlotCap ctSlot);
y <- updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) cap));
return []
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1345 (cte_Ptr ctSlot) capa 1 x2 x1 x2a\<rbrace> unmapPage (capVPSize cap) x1 x2a (capVPBasePtr cap) \<lbrace>?Q1337 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a\<rbrace>
 3. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> ((\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s \<and> True) \<circ> capCap) cap a) and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ((\<lambda>a. \<forall>xa xb. x = (xa, xb) \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cap) \<le> gsMaxObjectSize s) and (\<lambda>_. xa \<le> mask local.asid_bits \<and> vmsz_aligned' xb (capVPSize cap) \<and> xb < pptrBase) and ?R1345 ctSlota capa ret__unsigned_long x xa xb) a) and (\<lambda>_. ret__unsigned_long \<noteq> 0)) s)
 4. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = generic_frame_cap_get_capFMappedAddress_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_4_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = (xa, xb) \<longrightarrow> s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cap \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = xa\<rbrace> \<inter> \<lbrace>\<acute>vptr = xb\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'1350 ctSlota capa ret__unsigned_long x v va vb vc xa xb t rv}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}}
 5. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}
flex-flex pairs:
\<lambda>capa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a t rv. ?Q'1351 capa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv (xfdc t) \<equiv>\<^sup>? \<lambda>capa. ?Q'1350 (cte_Ptr ctSlot) capa 1 proof (prove)
goal (5 subgoals):
 1. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1337 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv) (?Q'1351 capa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) [SKIP] (do a <- do a <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) a))
od;
return []
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1345 (cte_Ptr ctSlot) capa 1 x2 x1 x2a\<rbrace> unmapPage (capVPSize cap) x1 x2a (capVPBasePtr cap) \<lbrace>?Q1337 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a\<rbrace>
 3. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> ((\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s \<and> True) \<circ> capCap) cap a) and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ((\<lambda>a. \<forall>xa xb. x = (xa, xb) \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cap) \<le> gsMaxObjectSize s) and (\<lambda>_. xa \<le> mask local.asid_bits \<and> vmsz_aligned' xb (capVPSize cap) \<and> xb < pptrBase) and ?R1345 ctSlota capa ret__unsigned_long x xa xb) a) and (\<lambda>_. ret__unsigned_long \<noteq> 0)) s)
 4. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = generic_frame_cap_get_capFMappedAddress_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_4_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = (xa, xb) \<longrightarrow> s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cap \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = xa\<rbrace> \<inter> \<lbrace>\<acute>vptr = xb\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'1350 ctSlota capa ret__unsigned_long x v va vb vc xa xb t rv}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}}
 5. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}
flex-flex pairs:
\<lambda>capa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a t rv. ?Q'1351 capa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv (xfdc t) \<equiv>\<^sup>? \<lambda>capa. ?Q'1350 (cte_Ptr ctSlot) capa 1 proof (prove)
goal (9 subgoals):
 1. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (?r'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) (?xf'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) (?P1399 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv) (?Q'1351 capa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) [] (do a <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) a))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,0)))
 2. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rv' t t'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) rv' t t' (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rv')
 3. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva rv'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc; ?r'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva) (?Q'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva rv') [SKIP] (return []) (?d'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rv')
 4. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1397 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv\<rbrace> do a <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) a))
od \<lbrace>?Q1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc\<rbrace>
 5. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) (?xf'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) (?Q'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc)
 6. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1345 (cte_Ptr ctSlot) capa 1 x2 x1 x2a\<rbrace> unmapPage (capVPSize cap) x1 x2a (capVPBasePtr cap) \<lbrace>\<lambda>a. ?P1399 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a a and ?R1397 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a a\<rbrace>
 7. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> ((\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s \<and> True) \<circ> capCap) cap a) and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ((\<lambda>a. \<forall>xa xb. x = (xa, xb) \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cap) \<le> gsMaxObjectSize s) and (\<lambda>_. xa \<le> mask local.asid_bits \<and> vmsz_aligned' xb (capVPSize cap) \<and> xb < pptrBase) and ?R1345 ctSlota capa ret__unsigned_long x xa xb) a) and (\<lambda>_. ret__unsigned_long \<noteq> 0)) s)
 8. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = generic_frame_cap_get_capFMappedAddress_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_4_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = (xa, xb) \<longrightarrow> s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cap \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = xa\<rbrace> \<inter> \<lbrace>\<acute>vptr = xb\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'1350 ctSlota capa ret__unsigned_long x v va vb vc xa xb t rv}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}}
 9. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}
flex-flex pairs:
\<lambda>capa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a t rv. ?Q'1351 capa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv (xfdc t) \<equiv>\<^sup>? \<lambda>capa. ?Q'1350 (cte_Ptr ctSlot) capa 1 proof (prove)
goal (10 subgoals):
 1. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> cte_wp_at' (\<lambda>_. True) ctSlot s \<and> True \<longrightarrow> s' \<Turnstile>\<^sub>c ctSlota
 2. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (?r'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) (?xf'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) (?A1411 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv) (?C'1409 capa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) [] (do a <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) a))
od) (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,0))
 3. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rv' t t'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) rv' t t' (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rv')
 4. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva rv'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc; ?r'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva) (?Q'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva rv') [SKIP] (return []) (?d'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rv')
 5. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1397 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv\<rbrace> do a <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) a))
od \<lbrace>?Q1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc\<rbrace>
 6. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) (?xf'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) (?Q'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc)
 7. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1345 (cte_Ptr ctSlot) capa 1 x2 x1 x2a\<rbrace> unmapPage (capVPSize cap) x1 x2a (capVPBasePtr cap) \<lbrace>\<lambda>a. ?A1411 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a a and cte_wp_at' (\<lambda>_. True) ctSlot and ?R1397 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a a\<rbrace>
 8. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> ((\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s \<and> True) \<circ> capCap) cap a) and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ((\<lambda>a. \<forall>xa xb. x = (xa, xb) \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cap) \<le> gsMaxObjectSize s) and (\<lambda>_. xa \<le> mask local.asid_bits \<and> vmsz_aligned' xb (capVPSize cap) \<and> xb < pptrBase) and ?R1345 ctSlota capa ret__unsigned_long x xa xb) a) and (\<lambda>_. ret__unsigned_long \<noteq> 0)) s)
 9. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = generic_frame_cap_get_capFMappedAddress_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_4_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = (xa, xb) \<longrightarrow> s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cap \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = xa\<rbrace> \<inter> \<lbrace>\<acute>vptr = xb\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?C'1408 ctSlota capa ret__unsigned_long x v va vb vc xa xb t rv \<inter> \<lbrace>True\<rbrace>}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}}
 10. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}
flex-flex pairs:
\<lambda>capa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a t rv. ?C'1409 capa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv (xfdc t) \<equiv>\<^sup>? \<lambda>capa. ?C'1408 (cte_Ptr ctSlot) capa 1 proof (prove)
goal (10 subgoals):
 1. \<And>capa x1 x2a s s' cte. \<lbrakk>ccap_relation (capability.ArchObjectCap cap) capa; capVPMappedAddress cap = Some (x1, x2a); generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; (s, s') \<in> rf_sr; ctes_of s ctSlot = Some cte\<rbrakk> \<Longrightarrow> s' \<Turnstile>\<^sub>c cte_Ptr ctSlot
 2. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (?r'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) (?xf'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) (?A1411 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv) (?C'1409 capa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) [] (do a <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) a))
od) (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,0))
 3. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rv' t t'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) rv' t t' (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rv')
 4. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva rv'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc; ?r'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva) (?Q'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva rv') [SKIP] (return []) (?d'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rv')
 5. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1397 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv\<rbrace> do a <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) a))
od \<lbrace>?Q1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc\<rbrace>
 6. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) (?xf'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) (?Q'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc)
 7. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1345 (cte_Ptr ctSlot) capa 1 x2 x1 x2a\<rbrace> unmapPage (capVPSize cap) x1 x2a (capVPBasePtr cap) \<lbrace>\<lambda>a. ?A1411 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a a and cte_wp_at' (\<lambda>_. True) ctSlot and ?R1397 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a a\<rbrace>
 8. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> ((\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s \<and> True) \<circ> capCap) cap a) and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ((\<lambda>a. \<forall>xa xb. x = (xa, xb) \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cap) \<le> gsMaxObjectSize s) and (\<lambda>_. xa \<le> mask local.asid_bits \<and> vmsz_aligned' xb (capVPSize cap) \<and> xb < pptrBase) and ?R1345 ctSlota capa ret__unsigned_long x xa xb) a) and (\<lambda>_. ret__unsigned_long \<noteq> 0)) s)
 9. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = generic_frame_cap_get_capFMappedAddress_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_4_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = (xa, xb) \<longrightarrow> s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cap \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = xa\<rbrace> \<inter> \<lbrace>\<acute>vptr = xb\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?C'1408 ctSlota capa ret__unsigned_long x v va vb vc xa xb t rv \<inter> \<lbrace>True\<rbrace>}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}}
 10. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}
flex-flex pairs:
\<lambda>capa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a t rv. ?C'1409 capa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv (xfdc t) \<equiv>\<^sup>? \<lambda>capa. ?C'1408 (cte_Ptr ctSlot) capa 1 proof (prove)
goal (10 subgoals):
 1. \<And>capa x1 x2a s s' cte. \<lbrakk>ccap_relation (capability.ArchObjectCap cap) capa; capVPMappedAddress cap = Some (x1, x2a); generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ctes_of s ctSlot = Some cte; \<exists>cte'. cslift s' (cte_Ptr ctSlot) = Some cte' \<and> cte_lift cte' \<noteq> None \<and> cte = cte_to_H (the (cte_lift cte')) \<and> c_valid_cte cte'\<rbrakk> \<Longrightarrow> s' \<Turnstile>\<^sub>c cte_Ptr ctSlot
 2. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (?r'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) (?xf'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) (?A1411 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv) (?C'1409 capa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) [] (do a <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) a))
od) (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,0))
 3. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rv' t t'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) rv' t t' (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rv')
 4. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva rv'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc; ?r'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva) (?Q'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva rv') [SKIP] (return []) (?d'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rv')
 5. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1397 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv\<rbrace> do a <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) a))
od \<lbrace>?Q1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc\<rbrace>
 6. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) (?xf'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) (?Q'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc)
 7. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1345 (cte_Ptr ctSlot) capa 1 x2 x1 x2a\<rbrace> unmapPage (capVPSize cap) x1 x2a (capVPBasePtr cap) \<lbrace>\<lambda>a. ?A1411 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a a and cte_wp_at' (\<lambda>_. True) ctSlot and ?R1397 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a a\<rbrace>
 8. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> ((\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s \<and> True) \<circ> capCap) cap a) and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ((\<lambda>a. \<forall>xa xb. x = (xa, xb) \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cap) \<le> gsMaxObjectSize s) and (\<lambda>_. xa \<le> mask local.asid_bits \<and> vmsz_aligned' xb (capVPSize cap) \<and> xb < pptrBase) and ?R1345 ctSlota capa ret__unsigned_long x xa xb) a) and (\<lambda>_. ret__unsigned_long \<noteq> 0)) s)
 9. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = generic_frame_cap_get_capFMappedAddress_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_4_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = (xa, xb) \<longrightarrow> s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cap \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = xa\<rbrace> \<inter> \<lbrace>\<acute>vptr = xb\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?C'1408 ctSlota capa ret__unsigned_long x v va vb vc xa xb t rv \<inter> \<lbrace>True\<rbrace>}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}}
 10. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}
flex-flex pairs:
\<lambda>capa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a t rv. ?C'1409 capa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv (xfdc t) \<equiv>\<^sup>? \<lambda>capa. ?C'1408 (cte_Ptr ctSlot) capa 1 proof (prove)
goal (9 subgoals):
 1. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (?r'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) (?xf'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) (?A1411 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv) (?C'1409 capa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) [] (do a <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) a))
od) (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,0))
 2. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rv' t t'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) rv' t t' (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rv')
 3. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva rv'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc; ?r'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva) (?Q'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva rv') [SKIP] (return []) (?d'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rv')
 4. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1397 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv\<rbrace> do a <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) a))
od \<lbrace>?Q1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc\<rbrace>
 5. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) (?xf'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) (?Q'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc)
 6. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1345 (cte_Ptr ctSlot) capa 1 x2 x1 x2a\<rbrace> unmapPage (capVPSize cap) x1 x2a (capVPBasePtr cap) \<lbrace>\<lambda>a. ?A1411 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a a and cte_wp_at' (\<lambda>_. True) ctSlot and ?R1397 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a a\<rbrace>
 7. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> ((\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s \<and> True) \<circ> capCap) cap a) and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ((\<lambda>a. \<forall>xa xb. x = (xa, xb) \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cap) \<le> gsMaxObjectSize s) and (\<lambda>_. xa \<le> mask local.asid_bits \<and> vmsz_aligned' xb (capVPSize cap) \<and> xb < pptrBase) and ?R1345 ctSlota capa ret__unsigned_long x xa xb) a) and (\<lambda>_. ret__unsigned_long \<noteq> 0)) s)
 8. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = generic_frame_cap_get_capFMappedAddress_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_4_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = (xa, xb) \<longrightarrow> s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cap \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = xa\<rbrace> \<inter> \<lbrace>\<acute>vptr = xb\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?C'1408 ctSlota capa ret__unsigned_long x v va vb vc xa xb t rv \<inter> \<lbrace>True\<rbrace>}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}}
 9. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}
flex-flex pairs:
\<lambda>capa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a t rv. ?C'1409 capa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv (xfdc t) \<equiv>\<^sup>? \<lambda>capa. ?C'1408 (cte_Ptr ctSlot) capa 1 proof (prove)
goal (12 subgoals):
 1. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (?r'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) (?xf'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) (?Q1454 capa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva) (?Q'1452 capa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva) [] (updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) rva))) (CALL generic_frame_cap_ptr_set_capFMappedAddress_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) asidInvalid,0))
 2. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM capCap (getSlotCap ctSlot) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?A1411 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv\<rbrace> liftM capCap (getSlotCap ctSlot) \<lbrace>?Q1454 capa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc\<rbrace>
 4. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> empty_fail (liftM capCap (getSlotCap ctSlot))
 5. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rv' t t'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) rv' t t' (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rv')
 6. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva rv'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc; ?r'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva) (?Q'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva rv') [SKIP] (return []) (?d'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rv')
 7. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1397 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv\<rbrace> do a <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) a))
od \<lbrace>?Q1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc\<rbrace>
 8. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) (?xf'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc) (?Q'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc)
 9. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1345 (cte_Ptr ctSlot) capa 1 x2 x1 x2a\<rbrace> unmapPage (capVPSize cap) x1 x2a (capVPBasePtr cap) \<lbrace>\<lambda>a. ?A1411 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a a and cte_wp_at' (\<lambda>_. True) ctSlot and ?R1397 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a a\<rbrace>
 10. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> ((\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s \<and> True) \<circ> capCap) cap a) and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ((\<lambda>a. \<forall>xa xb. x = (xa, xb) \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cap) \<le> gsMaxObjectSize s) and (\<lambda>_. xa \<le> mask local.asid_bits \<and> vmsz_aligned' xb (capVPSize cap) \<and> xb < pptrBase) and ?R1345 ctSlota capa ret__unsigned_long x xa xb) a) and (\<lambda>_. ret__unsigned_long \<noteq> 0)) s)
A total of 12 subgoals...
flex-flex pairs:
\<lambda>capa. ?Q1456 (cte_Ptr ctSlot) capa 1 \<equiv>\<^sup>? \<lambda>capa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a t rv. ?Q1454 capa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv (xfdc t)
\<lambda>capa. ?Q'1455 (cte_Ptr ctSlot) capa 1 \<equiv>\<^sup>? \<lambda>capa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a t rv. ?Q'1452 capa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv (xfdc t) proof (prove)
goal (11 subgoals):
 1. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> liftM capCap (getSlotCap ctSlot) \<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?A1411 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv\<rbrace> liftM capCap (getSlotCap ctSlot) \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>c. capability.ArchObjectCap a = cteCap c) ctSlot and K (isPageCap a)\<rbrace>
 3. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> empty_fail (liftM capCap (getSlotCap ctSlot))
 4. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdca rv' t t'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdca\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdca rv')
 5. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva rv'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc; dc rva rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva) (?Q'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva rv') [SKIP] (return []) (?d'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rv')
 6. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1397 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv\<rbrace> do a <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) a))
od \<lbrace>?Q1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc\<rbrace>
 7. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdca. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdca)
 8. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1345 (cte_Ptr ctSlot) capa 1 x2 x1 x2a\<rbrace> unmapPage (capVPSize cap) x1 x2a (capVPBasePtr cap) \<lbrace>\<lambda>a. ?A1411 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a a and cte_wp_at' (\<lambda>_. True) ctSlot and ?R1397 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a a\<rbrace>
 9. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> ((\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s \<and> True) \<circ> capCap) cap a) and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ((\<lambda>a. \<forall>xa xb. x = (xa, xb) \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cap) \<le> gsMaxObjectSize s) and (\<lambda>_. xa \<le> mask local.asid_bits \<and> vmsz_aligned' xb (capVPSize cap) \<and> xb < pptrBase) and ?R1345 ctSlota capa ret__unsigned_long x xa xb) a) and (\<lambda>_. ret__unsigned_long \<noteq> 0)) s)
 10. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = generic_frame_cap_get_capFMappedAddress_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_4_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = (xa, xb) \<longrightarrow> s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cap \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = xa\<rbrace> \<inter> \<lbrace>\<acute>vptr = xb\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv)) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?A1411 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv\<rbrace> liftM capCap (getSlotCap ctSlot) \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>c. capability.ArchObjectCap a = cteCap c) ctSlot and K (isPageCap a)\<rbrace>
 2. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> empty_fail (liftM capCap (getSlotCap ctSlot))
 3. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdca rv' t t'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdca\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdca rv')
 4. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva rv'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc; dc rva rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva) (?Q'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva rv') [SKIP] (return []) (?d'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rv')
 5. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1397 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv\<rbrace> do a <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) a))
od \<lbrace>?Q1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc\<rbrace>
 6. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdca. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdca)
 7. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1345 (cte_Ptr ctSlot) capa 1 x2 x1 x2a\<rbrace> unmapPage (capVPSize cap) x1 x2a (capVPBasePtr cap) \<lbrace>\<lambda>a. ?A1411 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a a and cte_wp_at' (\<lambda>_. True) ctSlot and ?R1397 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a a\<rbrace>
 8. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> ((\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s \<and> True) \<circ> capCap) cap a) and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ((\<lambda>a. \<forall>xa xb. x = (xa, xb) \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cap) \<le> gsMaxObjectSize s) and (\<lambda>_. xa \<le> mask local.asid_bits \<and> vmsz_aligned' xb (capVPSize cap) \<and> xb < pptrBase) and ?R1345 ctSlota capa ret__unsigned_long x xa xb) a) and (\<lambda>_. ret__unsigned_long \<noteq> 0)) s)
 9. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = generic_frame_cap_get_capFMappedAddress_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_4_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = (xa, xb) \<longrightarrow> s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cap \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = xa\<rbrace> \<inter> \<lbrace>\<acute>vptr = xb\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv)) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}}
 10. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (9 subgoals):
 1. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> empty_fail (liftM capCap (getSlotCap ctSlot))
 2. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdca rv' t t'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdca\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdca rv')
 3. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva rv'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc; dc rva rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva) (?Q'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva rv') [SKIP] (return []) (?d'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rv')
 4. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1397 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv\<rbrace> do a <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) a))
od \<lbrace>?Q1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc\<rbrace>
 5. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdca. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdca)
 6. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1345 (cte_Ptr ctSlot) capa 1 x2 x1 x2a\<rbrace> unmapPage (capVPSize cap) x1 x2a (capVPBasePtr cap) \<lbrace>\<lambda>a. (\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s) \<circ> capCap) cap a) and cte_wp_at' (\<lambda>_. True) ctSlot and ?R1397 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a a\<rbrace>
 7. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> ((\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s \<and> True) \<circ> capCap) cap a) and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ((\<lambda>a. \<forall>xa xb. x = (xa, xb) \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cap) \<le> gsMaxObjectSize s) and (\<lambda>_. xa \<le> mask local.asid_bits \<and> vmsz_aligned' xb (capVPSize cap) \<and> xb < pptrBase) and ?R1345 ctSlota capa ret__unsigned_long x xa xb) a) and (\<lambda>_. ret__unsigned_long \<noteq> 0)) s)
 8. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = generic_frame_cap_get_capFMappedAddress_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_4_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = (xa, xb) \<longrightarrow> s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cap \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = xa\<rbrace> \<inter> \<lbrace>\<acute>vptr = xb\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv)) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}}
 9. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (8 subgoals):
 1. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdca rv' t t'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdca\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdca rv')
 2. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva rv'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc; dc rva rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva) (?Q'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva rv') [SKIP] (return []) (?d'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rv')
 3. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1397 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv\<rbrace> do a <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) a))
od \<lbrace>?Q1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc\<rbrace>
 4. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdca. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdca)
 5. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1345 (cte_Ptr ctSlot) capa 1 x2 x1 x2a\<rbrace> unmapPage (capVPSize cap) x1 x2a (capVPBasePtr cap) \<lbrace>\<lambda>a. (\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s) \<circ> capCap) cap a) and cte_wp_at' (\<lambda>_. True) ctSlot and ?R1397 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a a\<rbrace>
 6. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> ((\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s \<and> True) \<circ> capCap) cap a) and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ((\<lambda>a. \<forall>xa xb. x = (xa, xb) \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cap) \<le> gsMaxObjectSize s) and (\<lambda>_. xa \<le> mask local.asid_bits \<and> vmsz_aligned' xb (capVPSize cap) \<and> xb < pptrBase) and ?R1345 ctSlota capa ret__unsigned_long x xa xb) a) and (\<lambda>_. ret__unsigned_long \<noteq> 0)) s)
 7. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = generic_frame_cap_get_capFMappedAddress_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_4_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = (xa, xb) \<longrightarrow> s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cap \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = xa\<rbrace> \<inter> \<lbrace>\<acute>vptr = xb\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv)) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}}
 8. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (7 subgoals):
 1. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva rv'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc; dc rva rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva) (?Q'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva rv') [SKIP] (return []) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1397 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv\<rbrace> do a <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) a))
od \<lbrace>?Q1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc\<rbrace>
 3. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdca. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1392 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdca)
 4. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1345 (cte_Ptr ctSlot) capa 1 x2 x1 x2a\<rbrace> unmapPage (capVPSize cap) x1 x2a (capVPBasePtr cap) \<lbrace>\<lambda>a. (\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s) \<circ> capCap) cap a) and cte_wp_at' (\<lambda>_. True) ctSlot and ?R1397 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a a\<rbrace>
 5. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> ((\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s \<and> True) \<circ> capCap) cap a) and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ((\<lambda>a. \<forall>xa xb. x = (xa, xb) \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cap) \<le> gsMaxObjectSize s) and (\<lambda>_. xa \<le> mask local.asid_bits \<and> vmsz_aligned' xb (capVPSize cap) \<and> xb < pptrBase) and ?R1345 ctSlota capa ret__unsigned_long x xa xb) a) and (\<lambda>_. ret__unsigned_long \<noteq> 0)) s)
 6. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = generic_frame_cap_get_capFMappedAddress_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_4_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = (xa, xb) \<longrightarrow> s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cap \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = xa\<rbrace> \<inter> \<lbrace>\<acute>vptr = xb\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv)) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}}
 7. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (7 subgoals):
 1. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva rv'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc; dc rva rv'\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return [] \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1397 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv\<rbrace> do a <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) a))
od \<lbrace>\<lambda>rva _. True\<rbrace>
 3. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdca. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'. UNIV)
 4. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1345 (cte_Ptr ctSlot) capa 1 x2 x1 x2a\<rbrace> unmapPage (capVPSize cap) x1 x2a (capVPBasePtr cap) \<lbrace>\<lambda>a. (\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s) \<circ> capCap) cap a) and cte_wp_at' (\<lambda>_. True) ctSlot and ?R1397 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a a\<rbrace>
 5. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> ((\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s \<and> True) \<circ> capCap) cap a) and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ((\<lambda>a. \<forall>xa xb. x = (xa, xb) \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cap) \<le> gsMaxObjectSize s) and (\<lambda>_. xa \<le> mask local.asid_bits \<and> vmsz_aligned' xb (capVPSize cap) \<and> xb < pptrBase) and ?R1345 ctSlota capa ret__unsigned_long x xa xb) a) and (\<lambda>_. ret__unsigned_long \<noteq> 0)) s)
 6. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = generic_frame_cap_get_capFMappedAddress_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_4_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = (xa, xb) \<longrightarrow> s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cap \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = xa\<rbrace> \<inter> \<lbrace>\<acute>vptr = xb\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv)) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}}
 7. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (7 subgoals):
 1. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc rva rv' \<sigma>. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc; dc rva rv'\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return [] \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (K (K (\<lambda>_. False)) \<currency> dc) (Inr rv) (liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>))}
 2. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1397 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv\<rbrace> do a <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) a))
od \<lbrace>\<lambda>rva _. True\<rbrace>
 3. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdca. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'. UNIV)
 4. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1345 (cte_Ptr ctSlot) capa 1 x2 x1 x2a\<rbrace> unmapPage (capVPSize cap) x1 x2a (capVPBasePtr cap) \<lbrace>\<lambda>a. (\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s) \<circ> capCap) cap a) and cte_wp_at' (\<lambda>_. True) ctSlot and ?R1397 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a a\<rbrace>
 5. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> ((\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s \<and> True) \<circ> capCap) cap a) and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ((\<lambda>a. \<forall>xa xb. x = (xa, xb) \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cap) \<le> gsMaxObjectSize s) and (\<lambda>_. xa \<le> mask local.asid_bits \<and> vmsz_aligned' xb (capVPSize cap) \<and> xb < pptrBase) and ?R1345 ctSlota capa ret__unsigned_long x xa xb) a) and (\<lambda>_. ret__unsigned_long \<noteq> 0)) s)
 6. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = generic_frame_cap_get_capFMappedAddress_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_4_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = (xa, xb) \<longrightarrow> s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cap \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = xa\<rbrace> \<inter> \<lbrace>\<acute>vptr = xb\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv)) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}}
 7. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (6 subgoals):
 1. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdc. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1397 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv\<rbrace> do a <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capVPMappedAddress_update (\<lambda>_. None) a))
od \<lbrace>\<lambda>rva _. True\<rbrace>
 2. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdca. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'. UNIV)
 3. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1345 (cte_Ptr ctSlot) capa 1 x2 x1 x2a\<rbrace> unmapPage (capVPSize cap) x1 x2a (capVPBasePtr cap) \<lbrace>\<lambda>a. (\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s) \<circ> capCap) cap a) and cte_wp_at' (\<lambda>_. True) ctSlot and ?R1397 ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a a\<rbrace>
 4. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> ((\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s \<and> True) \<circ> capCap) cap a) and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ((\<lambda>a. \<forall>xa xb. x = (xa, xb) \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cap) \<le> gsMaxObjectSize s) and (\<lambda>_. xa \<le> mask local.asid_bits \<and> vmsz_aligned' xb (capVPSize cap) \<and> xb < pptrBase) and ?R1345 ctSlota capa ret__unsigned_long x xa xb) a) and (\<lambda>_. ret__unsigned_long \<noteq> 0)) s)
 5. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = generic_frame_cap_get_capFMappedAddress_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_4_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = (xa, xb) \<longrightarrow> s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cap \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = xa\<rbrace> \<inter> \<lbrace>\<acute>vptr = xb\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv)) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}}
 6. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (5 subgoals):
 1. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a rv xfdca. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a); dc rv xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'. UNIV)
 2. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1345 (cte_Ptr ctSlot) capa 1 x2 x1 x2a\<rbrace> unmapPage (capVPSize cap) x1 x2a (capVPBasePtr cap) \<lbrace>\<lambda>a. (\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s) \<circ> capCap) cap a) and cte_wp_at' (\<lambda>_. True) ctSlot and (\<lambda>a. True)\<rbrace>
 3. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> ((\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s \<and> True) \<circ> capCap) cap a) and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ((\<lambda>a. \<forall>xa xb. x = (xa, xb) \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cap) \<le> gsMaxObjectSize s) and (\<lambda>_. xa \<le> mask local.asid_bits \<and> vmsz_aligned' xb (capVPSize cap) \<and> xb < pptrBase) and ?R1345 ctSlota capa ret__unsigned_long x xa xb) a) and (\<lambda>_. ret__unsigned_long \<noteq> 0)) s)
 4. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = generic_frame_cap_get_capFMappedAddress_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_4_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = (xa, xb) \<longrightarrow> s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cap \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = xa\<rbrace> \<inter> \<lbrace>\<acute>vptr = xb\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv)) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}}
 5. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (4 subgoals):
 1. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some x2; generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1345 (cte_Ptr ctSlot) capa 1 x2 x1 x2a\<rbrace> unmapPage (capVPSize cap) x1 x2a (capVPBasePtr cap) \<lbrace>\<lambda>a. (\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s) \<circ> capCap) cap a) and cte_wp_at' (\<lambda>_. True) ctSlot and (\<lambda>a. True)\<rbrace>
 2. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> ((\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s \<and> True) \<circ> capCap) cap a) and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ((\<lambda>a. \<forall>xa xb. x = (xa, xb) \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cap) \<le> gsMaxObjectSize s) and (\<lambda>_. xa \<le> mask local.asid_bits \<and> vmsz_aligned' xb (capVPSize cap) \<and> xb < pptrBase) and ?R1345 ctSlota capa ret__unsigned_long x xa xb) a) and (\<lambda>_. ret__unsigned_long \<noteq> 0)) s)
 3. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = generic_frame_cap_get_capFMappedAddress_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_4_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = (xa, xb) \<longrightarrow> s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cap \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = xa\<rbrace> \<inter> \<lbrace>\<acute>vptr = xb\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv)) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}}
 4. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (4 subgoals):
 1. \<And>ctSlota capa ret__unsigned_longa x2 ret__unsigned_long unsigned_long_eret_2 unsigned_long_eret_3 unsigned_long_eret_4 x1 x2a. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_longa = 1; capVPMappedAddress cap = Some (x1, x2a); generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0; ret__unsigned_long = generic_frame_cap_get_capFSize_CL (cap_lift capa); unsigned_long_eret_2 = generic_frame_cap_get_capFMappedASID_CL (cap_lift capa); unsigned_long_eret_3 = generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa); unsigned_long_eret_4 = generic_frame_cap_get_capFBasePtr_CL (cap_lift capa); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R1345 (cte_Ptr ctSlot) capa 1 (x1, x2a) x1 x2a\<rbrace> unmapPage (capVPSize cap) x1 x2a (capVPBasePtr cap) \<lbrace>\<lambda>a b. (\<forall>cap. (\<exists>cte. ctes_of b ctSlot = Some cte \<and> cteCap cte = cap) \<longrightarrow> (\<exists>cte. ctes_of b ctSlot = Some cte \<and> capability.ArchObjectCap (capCap cap) = cteCap cte) \<and> isPageCap (capCap cap)) \<and> (\<exists>cte. ctes_of b ctSlot = Some cte)\<rbrace>
 2. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> ((\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s \<and> True) \<circ> capCap) cap a) and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ((\<lambda>a. \<forall>xa xb. x = (xa, xb) \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cap) \<le> gsMaxObjectSize s) and (\<lambda>_. xa \<le> mask local.asid_bits \<and> vmsz_aligned' xb (capVPSize cap) \<and> xb < pptrBase) and ?R1345 ctSlota capa ret__unsigned_long x xa xb) a) and (\<lambda>_. ret__unsigned_long \<noteq> 0)) s)
 3. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = generic_frame_cap_get_capFMappedAddress_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_4_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = (xa, xb) \<longrightarrow> s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cap \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = xa\<rbrace> \<inter> \<lbrace>\<acute>vptr = xb\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv)) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}}
 4. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (3 subgoals):
 1. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s\<rbrakk> \<Longrightarrow> (capVPMappedAddress cap = None \<longrightarrow> ((\<lambda>a. \<forall>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) ctSlot a \<longrightarrow> ((\<lambda>rv s. cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot s \<and> K (isPageCap rv) s \<and> True) \<circ> capCap) cap a) and (\<lambda>_. ret__unsigned_long = 0)) s) \<and> (\<forall>x. capVPMappedAddress cap = Some x \<longrightarrow> ((\<lambda>a. \<forall>xa xb. x = (xa, xb) \<longrightarrow> (invs' and (\<lambda>s. 2 ^ pageBitsForSize (capVPSize cap) \<le> gsMaxObjectSize s) and (\<lambda>_. xa \<le> mask local.asid_bits \<and> vmsz_aligned' xb (capVPSize cap) \<and> xb < pptrBase) and (\<lambda>a. (\<forall>cap. (\<exists>cte. ctes_of a ctSlot = Some cte \<and> cteCap cte = cap) \<longrightarrow> (\<exists>cte. ctes_of a ctSlot = Some cte \<and> capability.ArchObjectCap (capCap cap) = cteCap cte) \<and> isPageCap (capCap cap)) \<and> (\<exists>cte. ctes_of a ctSlot = Some cte))) a) and (\<lambda>_. ret__unsigned_long \<noteq> 0)) s)
 2. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = generic_frame_cap_get_capFMappedAddress_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_4_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = (xa, xb) \<longrightarrow> s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cap \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = xa\<rbrace> \<inter> \<lbrace>\<acute>vptr = xb\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv)) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}}
 3. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (3 subgoals):
 1. \<And>capa s cte d v0 v1 v2 v3. \<lbrakk>ccap_relation (cteCap cte) capa; invs' s; cap = arch_capability.PageCap d v0 v1 v2 v3; ctes_of s ctSlot = Some cte; capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3) = cteCap cte\<rbrakk> \<Longrightarrow> (v3 = None \<longrightarrow> capability.ArchObjectCap (capCap (cteCap cte)) = cteCap cte \<and> (\<exists>d v0 v1 v2 v3. capCap (cteCap cte) = arch_capability.PageCap d v0 v1 v2 v3) \<and> generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0) \<and> (\<forall>a b. v3 = Some (a, b) \<longrightarrow> 2 ^ pageBitsForSize v2 \<le> gsMaxObjectSize s \<and> a \<le> mask local.asid_bits \<and> vmsz_aligned' b v2 \<and> b < pptrBase \<and> capability.ArchObjectCap (capCap (cteCap cte)) = cteCap cte \<and> (\<exists>d v0 v1 v2 v3. capCap (cteCap cte) = arch_capability.PageCap d v0 v1 v2 v3) \<and> generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0)
 2. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = generic_frame_cap_get_capFMappedAddress_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_4_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = (xa, xb) \<longrightarrow> s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cap \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = xa\<rbrace> \<inter> \<lbrace>\<acute>vptr = xb\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv)) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}}
 3. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (3 subgoals):
 1. \<And>capa s cte d v0 v1 v2 v3. \<lbrakk>ccap_relation (cteCap cte) capa; invs' s; cap = arch_capability.PageCap d v0 v1 v2 v3; ctes_of s ctSlot = Some cte; cteCap cte = capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)\<rbrakk> \<Longrightarrow> (v3 = None \<longrightarrow> capability.ArchObjectCap (capCap (cteCap cte)) = cteCap cte \<and> (\<exists>d v0 v1 v2 v3. capCap (cteCap cte) = arch_capability.PageCap d v0 v1 v2 v3) \<and> generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0) \<and> (\<forall>a b. v3 = Some (a, b) \<longrightarrow> 2 ^ pageBitsForSize v2 \<le> gsMaxObjectSize s \<and> a \<le> mask local.asid_bits \<and> vmsz_aligned' b v2 \<and> b < pptrBase \<and> capability.ArchObjectCap (capCap (cteCap cte)) = cteCap cte \<and> (\<exists>d v0 v1 v2 v3. capCap (cteCap cte) = arch_capability.PageCap d v0 v1 v2 v3) \<and> generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0)
 2. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = generic_frame_cap_get_capFMappedAddress_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_4_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = (xa, xb) \<longrightarrow> s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cap \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = xa\<rbrace> \<inter> \<lbrace>\<acute>vptr = xb\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv)) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}}
 3. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (3 subgoals):
 1. \<And>capa s cte d v0 v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) capa; invs' s; cap = arch_capability.PageCap d v0 v1 v2 v3; ctes_of s ctSlot = Some cte; cteCap cte = capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)\<rbrakk> \<Longrightarrow> (v3 = None \<longrightarrow> generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0) \<and> (\<forall>a b. v3 = Some (a, b) \<longrightarrow> 2 ^ pageBitsForSize v2 \<le> gsMaxObjectSize s \<and> a \<le> mask local.asid_bits \<and> vmsz_aligned' b v2 \<and> b < pptrBase \<and> generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0)
 2. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = generic_frame_cap_get_capFMappedAddress_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_4_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = (xa, xb) \<longrightarrow> s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cap \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = xa\<rbrace> \<inter> \<lbrace>\<acute>vptr = xb\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv)) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}}
 3. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (3 subgoals):
 1. \<And>capa s cte d v0 v1 v2 v3. \<lbrakk>invs' s; cap = arch_capability.PageCap d v0 v1 v2 v3; ctes_of s ctSlot = Some cte; cteCap cte = capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3); (generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 \<longrightarrow> v3 \<noteq> None) \<and> (generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0 \<longrightarrow> v3 = None)\<rbrakk> \<Longrightarrow> (v3 = None \<longrightarrow> generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0) \<and> (\<forall>a b. v3 = Some (a, b) \<longrightarrow> 2 ^ pageBitsForSize v2 \<le> gsMaxObjectSize s \<and> a \<le> mask local.asid_bits \<and> vmsz_aligned' b v2 \<and> b < pptrBase \<and> generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0)
 2. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = generic_frame_cap_get_capFMappedAddress_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_4_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = (xa, xb) \<longrightarrow> s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cap \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = xa\<rbrace> \<inter> \<lbrace>\<acute>vptr = xb\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv)) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}}
 3. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (3 subgoals):
 1. \<And>capa s cte d v0 v1 v2 v3. \<lbrakk>invs' s; cap = arch_capability.PageCap d v0 v1 v2 v3; ctes_of s ctSlot = Some cte; cteCap cte = capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3); (generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 \<longrightarrow> v3 \<noteq> None) \<and> (generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0 \<longrightarrow> v3 = None); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> (v3 = None \<longrightarrow> generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0) \<and> (\<forall>a b. v3 = Some (a, b) \<longrightarrow> 2 ^ pageBitsForSize v2 \<le> gsMaxObjectSize s \<and> a \<le> mask local.asid_bits \<and> vmsz_aligned' b v2 \<and> b < pptrBase \<and> generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0)
 2. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = generic_frame_cap_get_capFMappedAddress_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_4_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = (xa, xb) \<longrightarrow> s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cap \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = xa\<rbrace> \<inter> \<lbrace>\<acute>vptr = xb\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv)) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}}
 3. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (3 subgoals):
 1. \<And>capa s cte d v0 v1 v2 v3. \<lbrakk>invs' s; cap = arch_capability.PageCap d v0 v1 v2 v3; cteCap cte = capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3); (generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 \<longrightarrow> v3 \<noteq> None) \<and> (generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0 \<longrightarrow> v3 = None); valid_cap' (cteCap cte) s; kernel_data_refs \<inter> capRange (cteCap cte) = {} \<and> global_refs' s \<subseteq> kernel_data_refs \<and> 2 ^ capBits (cteCap cte) \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (v3 = None \<longrightarrow> generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0) \<and> (\<forall>a b. v3 = Some (a, b) \<longrightarrow> 2 ^ pageBitsForSize v2 \<le> gsMaxObjectSize s \<and> a \<le> mask local.asid_bits \<and> vmsz_aligned' b v2 \<and> b < pptrBase \<and> generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0)
 2. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = generic_frame_cap_get_capFMappedAddress_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_4_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = (xa, xb) \<longrightarrow> s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cap \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = xa\<rbrace> \<inter> \<lbrace>\<acute>vptr = xb\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv)) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}}
 3. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (2 subgoals):
 1. \<And>ctSlota capa ret__unsigned_long s. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned_long = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) \<noteq> 0 then 1 else 0); s \<in> ?G'476 ctSlota capa ret__unsigned_long\<rbrakk> \<Longrightarrow> s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = generic_frame_cap_get_capFMappedAddress_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_4_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = (xa, xb) \<longrightarrow> s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cap \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = xa\<rbrace> \<inter> \<lbrace>\<acute>vptr = xb\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv)) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}}
 2. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> ?G'476 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (1 subgoal):
 1. \<And>ctSlota capa s s'. \<lbrakk>ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>y. isPageCap cap)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and K (isPageCap cap)) s \<and> s' \<in> {s. \<forall>v v'. v = (if generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<noteq> 0 then 1 else 0) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. capVPMappedAddress cap = None \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv) and (\<lambda>a. True)) s \<longrightarrow> s' \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ctSlota}}} \<inter> {s. \<forall>x. s \<in> {s. capVPMappedAddress cap = Some x \<longrightarrow> s \<in> {s. \<forall>v v'. v = generic_frame_cap_get_capFSize_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. \<forall>va v'. va = generic_frame_cap_get_capFMappedASID_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_2_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = generic_frame_cap_get_capFMappedAddress_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_3_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = generic_frame_cap_get_capFBasePtr_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_long_eret_4_' := vc\<rparr> \<in> {s. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = (xa, xb) \<longrightarrow> s \<in> {s. pptr_'_update (\<lambda>_. PTR(unit) vc) (vptr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) (page_size_'_update (\<lambda>_. v) s))) \<in> UNIV \<inter> \<lbrace>gen_framesize_to_H \<acute>page_size = capVPSize cap \<and> \<acute>page_size < 4\<rbrace> \<inter> \<lbrace>\<acute>asid = xa\<rbrace> \<inter> \<lbrace>\<acute>vptr = xb\<rbrace> \<inter> \<lbrace>\<acute>pptr = PTR(unit) (capVPBasePtr cap)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (cte_wp_at' (\<lambda>c. capability.ArchObjectCap rv = cteCap c) ctSlot and K (isPageCap rv)) s \<longrightarrow> s' \<in> UNIV} \<inter> \<lbrace>True\<rbrace>}}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap}}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap} proof (prove)
goal (1 subgoal):
 1. \<And>capa s s' cte d v0 v1 v2 v3. \<lbrakk>ccap_relation (cteCap cte) capa; (s, s') \<in> rf_sr; invs' s; cap = arch_capability.PageCap d v0 v1 v2 v3; ctes_of s ctSlot = Some cte; capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3) = cteCap cte\<rbrakk> \<Longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (v3 = None \<longrightarrow> (\<exists>rv s. (s, s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s ctSlot = Some cte \<and> capability.ArchObjectCap rv = cteCap cte) \<and> (\<exists>d v0 v1 v2 v3. rv = arch_capability.PageCap d v0 v1 v2 v3)) \<longrightarrow> s' \<Turnstile>\<^sub>c cte_Ptr ctSlot) \<and> (\<forall>a b. (generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa) = b \<longrightarrow> generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = a \<longrightarrow> generic_frame_cap_get_capFSize_CL (cap_lift capa) < 4 \<longrightarrow> gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift capa)) = v2 \<longrightarrow> generic_frame_cap_get_capFBasePtr_CL (cap_lift capa) \<noteq> v0) \<longrightarrow> v3 \<noteq> Some (a, b))) \<and> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (v3 = None \<longrightarrow> (\<exists>rv s. (s, s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s ctSlot = Some cte \<and> capability.ArchObjectCap rv = cteCap cte) \<and> (\<exists>d v0 v1 v2 v3. rv = arch_capability.PageCap d v0 v1 v2 v3)) \<longrightarrow> s' \<Turnstile>\<^sub>c cte_Ptr ctSlot) \<and> (\<forall>a b. (generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa) = b \<longrightarrow> generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = a \<longrightarrow> generic_frame_cap_get_capFSize_CL (cap_lift capa) < 4 \<longrightarrow> gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift capa)) = v2 \<longrightarrow> generic_frame_cap_get_capFBasePtr_CL (cap_lift capa) \<noteq> v0) \<longrightarrow> v3 \<noteq> Some (a, b))) \<and> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) proof (prove)
goal (1 subgoal):
 1. \<And>capa s s' cte d v0 v1 v2 v3. \<lbrakk>ccap_relation (cteCap cte) capa; (s, s') \<in> rf_sr; invs' s; cap = arch_capability.PageCap d v0 v1 v2 v3; ctes_of s ctSlot = Some cte; cteCap cte = capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)\<rbrakk> \<Longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (v3 = None \<longrightarrow> (\<exists>rv s. (s, s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s ctSlot = Some cte \<and> capability.ArchObjectCap rv = cteCap cte) \<and> (\<exists>d v0 v1 v2 v3. rv = arch_capability.PageCap d v0 v1 v2 v3)) \<longrightarrow> s' \<Turnstile>\<^sub>c cte_Ptr ctSlot) \<and> (\<forall>a b. (generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa) = b \<longrightarrow> generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = a \<longrightarrow> generic_frame_cap_get_capFSize_CL (cap_lift capa) < 4 \<longrightarrow> gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift capa)) = v2 \<longrightarrow> generic_frame_cap_get_capFBasePtr_CL (cap_lift capa) \<noteq> v0) \<longrightarrow> v3 \<noteq> Some (a, b))) \<and> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (v3 = None \<longrightarrow> (\<exists>rv s. (s, s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s ctSlot = Some cte \<and> capability.ArchObjectCap rv = cteCap cte) \<and> (\<exists>d v0 v1 v2 v3. rv = arch_capability.PageCap d v0 v1 v2 v3)) \<longrightarrow> s' \<Turnstile>\<^sub>c cte_Ptr ctSlot) \<and> (\<forall>a b. (generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa) = b \<longrightarrow> generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = a \<longrightarrow> generic_frame_cap_get_capFSize_CL (cap_lift capa) < 4 \<longrightarrow> gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift capa)) = v2 \<longrightarrow> generic_frame_cap_get_capFBasePtr_CL (cap_lift capa) \<noteq> v0) \<longrightarrow> v3 \<noteq> Some (a, b))) \<and> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) proof (prove)
goal (1 subgoal):
 1. \<And>capa s s' cte d v0 v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) capa; (s, s') \<in> rf_sr; invs' s; cap = arch_capability.PageCap d v0 v1 v2 v3; ctes_of s ctSlot = Some cte; cteCap cte = capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)\<rbrakk> \<Longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (v3 = None \<longrightarrow> (\<exists>rv s. (s, s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s ctSlot = Some cte \<and> capability.ArchObjectCap rv = cteCap cte) \<and> (\<exists>d v0 v1 v2 v3. rv = arch_capability.PageCap d v0 v1 v2 v3)) \<longrightarrow> s' \<Turnstile>\<^sub>c cte_Ptr ctSlot) \<and> (\<forall>a b. (generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa) = b \<longrightarrow> generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = a \<longrightarrow> generic_frame_cap_get_capFSize_CL (cap_lift capa) < 4 \<longrightarrow> gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift capa)) = v2 \<longrightarrow> generic_frame_cap_get_capFBasePtr_CL (cap_lift capa) \<noteq> v0) \<longrightarrow> v3 \<noteq> Some (a, b))) \<and> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (v3 = None \<longrightarrow> (\<exists>rv s. (s, s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s ctSlot = Some cte \<and> capability.ArchObjectCap rv = cteCap cte) \<and> (\<exists>d v0 v1 v2 v3. rv = arch_capability.PageCap d v0 v1 v2 v3)) \<longrightarrow> s' \<Turnstile>\<^sub>c cte_Ptr ctSlot) \<and> (\<forall>a b. (generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa) = b \<longrightarrow> generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = a \<longrightarrow> generic_frame_cap_get_capFSize_CL (cap_lift capa) < 4 \<longrightarrow> gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift capa)) = v2 \<longrightarrow> generic_frame_cap_get_capFBasePtr_CL (cap_lift capa) \<noteq> v0) \<longrightarrow> v3 \<noteq> Some (a, b))) \<and> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) proof (prove)
goal (1 subgoal):
 1. \<And>capa s s' cte d v0 v1 v2 v3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) capa; (s, s') \<in> rf_sr; invs' s; cap = arch_capability.PageCap d v0 v1 v2 v3; ctes_of s ctSlot = Some cte; cteCap cte = capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3); \<exists>cte'. cslift s' (cte_Ptr ctSlot) = Some cte' \<and> cte_lift cte' \<noteq> None \<and> cte = cte_to_H (the (cte_lift cte')) \<and> c_valid_cte cte'\<rbrakk> \<Longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (v3 = None \<longrightarrow> (\<exists>rv s. (s, s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s ctSlot = Some cte \<and> capability.ArchObjectCap rv = cteCap cte) \<and> (\<exists>d v0 v1 v2 v3. rv = arch_capability.PageCap d v0 v1 v2 v3)) \<longrightarrow> s' \<Turnstile>\<^sub>c cte_Ptr ctSlot) \<and> (\<forall>a b. (generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa) = b \<longrightarrow> generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = a \<longrightarrow> generic_frame_cap_get_capFSize_CL (cap_lift capa) < 4 \<longrightarrow> gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift capa)) = v2 \<longrightarrow> generic_frame_cap_get_capFBasePtr_CL (cap_lift capa) \<noteq> v0) \<longrightarrow> v3 \<noteq> Some (a, b))) \<and> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (v3 = None \<longrightarrow> (\<exists>rv s. (s, s') \<in> rf_sr \<and> (\<exists>cte. ctes_of s ctSlot = Some cte \<and> capability.ArchObjectCap rv = cteCap cte) \<and> (\<exists>d v0 v1 v2 v3. rv = arch_capability.PageCap d v0 v1 v2 v3)) \<longrightarrow> s' \<Turnstile>\<^sub>c cte_Ptr ctSlot) \<and> (\<forall>a b. (generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa) = b \<longrightarrow> generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = a \<longrightarrow> generic_frame_cap_get_capFSize_CL (cap_lift capa) < 4 \<longrightarrow> gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift capa)) = v2 \<longrightarrow> generic_frame_cap_get_capFBasePtr_CL (cap_lift capa) \<noteq> v0) \<longrightarrow> v3 \<noteq> Some (a, b))) \<and> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) proof (prove)
goal (1 subgoal):
 1. \<And>capa s s' d v0 v1 v2 v3 cte' y. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) capa; (s, s') \<in> rf_sr; invs' s; cap = arch_capability.PageCap d v0 v1 v2 v3; ctes_of s ctSlot = Some (cte_to_H y); cap_to_H (cap_CL y) = capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3); cslift s' (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'\<rbrakk> \<Longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>a b. (generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa) = b \<longrightarrow> generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = a \<longrightarrow> generic_frame_cap_get_capFSize_CL (cap_lift capa) < 4 \<longrightarrow> gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift capa)) = v2 \<longrightarrow> generic_frame_cap_get_capFBasePtr_CL (cap_lift capa) \<noteq> v0) \<longrightarrow> v3 \<noteq> Some (a, b))) \<and> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>a b. (generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa) = b \<longrightarrow> generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = a \<longrightarrow> generic_frame_cap_get_capFSize_CL (cap_lift capa) < 4 \<longrightarrow> gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift capa)) = v2 \<longrightarrow> generic_frame_cap_get_capFBasePtr_CL (cap_lift capa) \<noteq> v0) \<longrightarrow> v3 \<noteq> Some (a, b))) \<and> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) proof (prove)
goal (1 subgoal):
 1. \<And>capa s s' d v0 v1 v2 v3 cte' y. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) capa; (s, s') \<in> rf_sr; invs' s; cap = arch_capability.PageCap d v0 v1 v2 v3; ctes_of s ctSlot = Some (cte_to_H y); cap_to_H (cap_CL y) = capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3); cslift s' (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; (v3 \<noteq> None \<longrightarrow> generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa) = snd (the v3) \<and> generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = fst (the v3)) \<and> (generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0) = (v3 = None) \<and> vmrights_to_H (generic_frame_cap_get_capFVMRights_CL (cap_lift capa)) = v1 \<and> gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift capa)) = v2 \<and> generic_frame_cap_get_capFBasePtr_CL (cap_lift capa) = v0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift capa) < 4 \<and> generic_frame_cap_get_capFSize_CL (cap_lift capa) < 4 \<and> to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift capa)) = d\<rbrakk> \<Longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>a b. (generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa) = b \<longrightarrow> generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = a \<longrightarrow> generic_frame_cap_get_capFSize_CL (cap_lift capa) < 4 \<longrightarrow> gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift capa)) = v2 \<longrightarrow> generic_frame_cap_get_capFBasePtr_CL (cap_lift capa) \<noteq> v0) \<longrightarrow> v3 \<noteq> Some (a, b))) \<and> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>a b. (generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa) = b \<longrightarrow> generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = a \<longrightarrow> generic_frame_cap_get_capFSize_CL (cap_lift capa) < 4 \<longrightarrow> gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift capa)) = v2 \<longrightarrow> generic_frame_cap_get_capFBasePtr_CL (cap_lift capa) \<noteq> v0) \<longrightarrow> v3 \<noteq> Some (a, b))) \<and> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) proof (prove)
goal (2 subgoals):
 1. \<And>capa s s' d v0 v1 v2 v3 cte' y. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) capa; (s, s') \<in> rf_sr; invs' s; cap = arch_capability.PageCap d v0 v1 v2 v3; ctes_of s ctSlot = Some (cte_to_H y); cap_to_H (cap_CL y) = capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3); cslift s' (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; (v3 \<noteq> None \<longrightarrow> generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa) = snd (the v3) \<and> generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = fst (the v3)) \<and> (generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0) = (v3 = None) \<and> vmrights_to_H (generic_frame_cap_get_capFVMRights_CL (cap_lift capa)) = v1 \<and> gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift capa)) = v2 \<and> generic_frame_cap_get_capFBasePtr_CL (cap_lift capa) = v0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift capa) < 4 \<and> generic_frame_cap_get_capFSize_CL (cap_lift capa) < 4 \<and> to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift capa)) = d; v2 = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>a b. (generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa) = b \<longrightarrow> generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = a \<longrightarrow> generic_frame_cap_get_capFSize_CL (cap_lift capa) < 4 \<longrightarrow> gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift capa)) = v2 \<longrightarrow> generic_frame_cap_get_capFBasePtr_CL (cap_lift capa) \<noteq> v0) \<longrightarrow> v3 \<noteq> Some (a, b))) \<and> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>a b. (generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa) = b \<longrightarrow> generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = a \<longrightarrow> generic_frame_cap_get_capFSize_CL (cap_lift capa) < 4 \<longrightarrow> gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift capa)) = v2 \<longrightarrow> generic_frame_cap_get_capFBasePtr_CL (cap_lift capa) \<noteq> v0) \<longrightarrow> v3 \<noteq> Some (a, b))) \<and> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap)
 2. \<And>capa s s' d v0 v1 v2 v3 cte' y. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) capa; (s, s') \<in> rf_sr; invs' s; cap = arch_capability.PageCap d v0 v1 v2 v3; ctes_of s ctSlot = Some (cte_to_H y); cap_to_H (cap_CL y) = capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3); cslift s' (cte_Ptr ctSlot) = Some cte'; cte_lift cte' = Some y; c_valid_cte cte'; (v3 \<noteq> None \<longrightarrow> generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa) = snd (the v3) \<and> generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = fst (the v3)) \<and> (generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = 0) = (v3 = None) \<and> vmrights_to_H (generic_frame_cap_get_capFVMRights_CL (cap_lift capa)) = v1 \<and> gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift capa)) = v2 \<and> generic_frame_cap_get_capFBasePtr_CL (cap_lift capa) = v0 \<and> generic_frame_cap_get_capFVMRights_CL (cap_lift capa) < 4 \<and> generic_frame_cap_get_capFSize_CL (cap_lift capa) < 4 \<and> to_bool (generic_frame_cap_get_capFIsDevice_CL (cap_lift capa)) = d; v2 \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<forall>a b. (generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa) = b \<longrightarrow> generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = a \<longrightarrow> generic_frame_cap_get_capFSize_CL (cap_lift capa) < 4 \<longrightarrow> gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift capa)) = v2 \<longrightarrow> generic_frame_cap_get_capFBasePtr_CL (cap_lift capa) \<noteq> v0) \<longrightarrow> v3 \<noteq> Some (a, b))) \<and> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>a b. (generic_frame_cap_get_capFMappedAddress_CL (cap_lift capa) = b \<longrightarrow> generic_frame_cap_get_capFMappedASID_CL (cap_lift capa) = a \<longrightarrow> generic_frame_cap_get_capFSize_CL (cap_lift capa) < 4 \<longrightarrow> gen_framesize_to_H (generic_frame_cap_get_capFSize_CL (cap_lift capa)) = v2 \<longrightarrow> generic_frame_cap_get_capFBasePtr_CL (cap_lift capa) \<noteq> v0) \<longrightarrow> v3 \<noteq> Some (a, b))) \<and> (cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<or> cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_frame_cap) proof (prove)
goal:
No subgoals!