theory ArchArch_AI

lemma arch_decode_inv_wf[wp]:
  "\<lbrace>invs and valid_cap (cap.ArchObjectCap arch_cap) and
    cte_wp_at ((=) (cap.ArchObjectCap arch_cap)) slot and
    (\<lambda>s. \<forall>x \<in> set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace>
     arch_decode_invocation label args cap_index slot arch_cap excaps
   \<lbrace>valid_arch_inv\<rbrace>,-" apply (cases arch_cap) apply (rename_tac word1 word2) apply (simp add: arch_decode_invocation_def Let_def split_def cong: if_cong split del: if_split) apply (rule hoare_pre) apply ((wp whenE_throwError_wp check_vp_wpR ensure_empty_stronger select_ext_weak_wp|
               wpc|
               simp add: valid_arch_inv_def valid_apinv_def)+)[1] apply (simp add: valid_arch_inv_def valid_apinv_def) apply (intro allI impI ballI) apply (elim conjE exE) apply simp apply (clarsimp simp: dom_def neq_Nil_conv) apply (thin_tac "Ball S P" for S P)+ apply (clarsimp simp: valid_cap_def) apply (rule conjI) apply (clarsimp simp: obj_at_def) apply (subgoal_tac "ucast (ucast xa + word2) = xa") apply simp apply (simp add: is_aligned_nth) apply (subst word_plus_and_or_coroll) apply (rule word_eqI) apply (clarsimp simp: word_size word_bits_def nth_ucast) apply (drule test_bit_size) apply (simp add: word_size asid_low_bits_def) apply (rule word_eqI) apply (clarsimp simp: word_size word_bits_def nth_ucast) apply (auto simp: asid_low_bits_def)[1] apply (rule conjI) apply (clarsimp simp add: cte_wp_at_caps_of_state) apply (rename_tac c c') apply (frule_tac cap="(ArchObjectCap (PageDirectoryCap xb None))" in caps_of_state_valid,
              assumption) apply (clarsimp simp: is_pd_cap_def cap_rights_update_def
                             acap_rights_update_def) apply (clarsimp simp: word_neq_0_conv) apply (rule conjI) apply (subst field_simps, erule is_aligned_add_less_t2n) apply (simp add: asid_low_bits_def) apply (rule ucast_less[where 'b=10, simplified], simp) apply (simp add: asid_low_bits_def asid_bits_def) apply (simp add: asid_bits_def) apply (drule vs_lookup_atI) apply (subst asid_high_bits_of_add_ucast, assumption) apply assumption apply (simp add: arch_decode_invocation_def Let_def split_def
                 cong: if_cong split del: if_split) apply (rule hoare_pre) apply ((wp whenE_throwError_wp check_vp_wpR ensure_empty_stronger|
              wpc|
              simp add: valid_arch_inv_def valid_aci_def is_aligned_shiftl_self)+)[1] apply (rule_tac Q'=
                         "\<lambda>rv. real_cte_at rv and
                               ex_cte_cap_wp_to is_cnode_cap rv and
                               (\<lambda>s. descendants_of (snd (excaps!0)) (cdt s) = {}) and
                               cte_wp_at (\<lambda>c. \<exists>idx. c = (cap.UntypedCap False frame pageBits idx)) (snd (excaps!0)) and
                               (\<lambda>s. arm_asid_table (arch_state s) free = None)"
                         in hoare_post_imp_R) apply (simp add: lookup_target_slot_def) apply wp apply (clarsimp simp: cte_wp_at_def) apply (rule conjI, clarsimp) apply (rule shiftl_less_t2n) apply (rule order_less_le_trans, rule ucast_less, simp) apply (simp add: asid_bits_def asid_low_bits_def) apply (simp add: asid_bits_def) apply (simp split del: if_split) apply (wp ensure_no_children_sp select_ext_weak_wp whenE_throwError_wp | wpc | simp)+ apply clarsimp apply (rule conjI, fastforce) apply (cases excaps, simp) apply (case_tac list, simp) apply clarsimp apply (rule conjI) apply (drule cte_wp_at_norm, clarsimp, drule cte_wp_valid_cap, fastforce)+ apply assumption apply (rule conjI) apply clarsimp apply (simp add: ex_cte_cap_wp_to_def) apply (rule_tac x=ac in exI) apply (rule_tac x=ba in exI) apply (clarsimp simp add: cte_wp_at_caps_of_state)+
    \<comment> \<open>PageCap\<close> apply (simp add: arch_decode_invocation_def Let_def split_def cong: if_cong split del: if_split) supply if_split[split del] apply (cases "invocation_type label = ArchInvocationLabel ARMPageMap") apply (rename_tac dev word rights vmpage_size option) apply (rule hoare_pre) apply (wp whenE_throwError_wp check_vp_wpR hoare_vcg_const_imp_lift_R
                create_mapping_entries_parent_for_refs find_pd_for_asid_pd_at_asid
                create_mapping_entries_valid_slots create_mapping_entries_same_refs_ex
                find_pd_for_asid_lookup_pd_wp hoare_vcg_disj_lift_R
                hoare_vcg_ex_lift_R
                (* these two lift rules must go last, list has overlapping rules *)
             | wpc
             | simp add: valid_arch_inv_def valid_page_inv_def is_pg_cap_def
                         cte_wp_at_caps_of_state[where P="\<lambda>c. same_refs rv c s" for rv s])+ apply (clarsimp simp: neq_Nil_conv invs_vspace_objs) apply (frule(1) caps_of_state_valid) apply (clarsimp simp: cte_wp_at_caps_of_state mask_cap_def) apply (rule conjI[rotated]; clarsimp split: if_splits simp: invs_vspace_objs) apply (auto, auto simp: cte_wp_at_caps_of_state invs_def valid_state_def
                              valid_cap_simps is_arch_update_def is_cap_simps
                              is_arch_cap_def cap_master_cap_simps
                              vmsz_aligned_def vs_cap_ref_def
                              cap_aligned_def data_at_def
                              le_mask_iff_lt_2n[where 'a=32, folded word_bits_def, THEN iffD1]
                              ord_eq_le_trans[OF pd_bits_14]
                              linorder_not_le aligned_sum_less_kernel_base
                        elim: is_aligned_weaken split: vmpage_size.split
                       split: if_splits
                      intro!: is_aligned_addrFromPPtr_n
                              pbfs_atleast_pageBits)[2] apply (cases "invocation_type label = ArchInvocationLabel ARMPageUnmap") apply simp apply (rule hoare_pre, wp) apply (clarsimp simp: valid_arch_inv_def valid_page_inv_def) apply (thin_tac "Ball S P" for S P) apply (clarsimp split: option.split) apply (clarsimp simp: valid_cap_def cap_aligned_def) apply (simp add: valid_unmap_def) apply (fastforce simp: vmsz_aligned_def elim: is_aligned_weaken intro!: pbfs_atleast_pageBits) apply (cases "isPageFlushLabel (invocation_type label)") apply (rule hoare_pre) apply simp apply (wp whenE_throwError_wp hoare_weak_lift_imp hoare_drop_imps) apply (simp add: valid_arch_inv_def valid_page_inv_def) apply (wp find_pd_for_asid_pd_at_asid | wpc)+ apply (clarsimp simp: valid_cap_def mask_def) apply (cases "invocation_type label = ArchInvocationLabel ARMPageGetAddress") apply simp apply (rule hoare_pre, wp) apply (clarsimp simp: valid_arch_inv_def valid_page_inv_def) apply simp apply (rule hoare_pre, wp) apply simp apply (simp add: arch_decode_invocation_def Let_def split_def
                    is_final_cap_def
               cong: if_cong) apply (rename_tac word option) apply (rule hoare_pre) apply ((wp whenE_throwError_wp check_vp_wpR get_master_pde_wp hoare_vcg_all_lift_R
            | wpc
            | simp add: valid_arch_inv_def valid_pti_def unlessE_whenE vs_cap_ref_def split: if_splits
            | rule_tac x="fst p" in hoare_imp_eq_substR
            | wp (once) hoare_vcg_ex_lift_R)+)[1] apply (rule_tac Q'="\<lambda>a b. ko_at (ArchObj (PageDirectory pd))
                                    (a + (args ! 0 >> 20 << 2) && ~~ mask pd_bits) b \<longrightarrow>
                                    pd (ucast (a + (args ! 0 >> 20 << 2) && mask pd_bits >> 2)) =
                                    InvalidPDE \<longrightarrow> L word option p pd a b" for L in hoare_post_imp_R[rotated]) apply (intro impI) apply (erule impE) apply clarsimp apply (erule impE) apply (clarsimp split: pde.splits) apply assumption apply ((wp whenE_throwError_wp hoare_vcg_all_lift_R
                    find_pd_for_asid_lookup_slot [unfolded lookup_pd_slot_def Let_def]
                    find_pd_for_asid_ref_offset_voodoo find_pd_for_asid_shifting_voodoo
                    find_pd_for_asid_inv
                 | wpc
                 | simp add: valid_arch_inv_def valid_pti_def unlessE_whenE empty_pde_atI
                             vs_cap_ref_def if_apply_def2
                 | wp (once) hoare_drop_imps hoare_vcg_ex_lift_R)+)[6] apply (clarsimp simp: is_cap_simps if_apply_def2) apply (rule conjI) apply clarsimp apply (rule conjI, fastforce) apply (rule conjI, fastforce) apply (clarsimp simp: neq_Nil_conv) apply (thin_tac "Ball S P" for S P) apply (rule conjI) apply (clarsimp simp: valid_cap_def cap_aligned_def
                           pt_bits_def pageBits_def is_aligned_addrFromPPtr_n) apply (rule conjI) apply (clarsimp simp: valid_cap_def cap_aligned_def) apply (rule conjI) apply (drule cte_wp_at_norm, clarsimp, drule cte_wp_valid_cap, fastforce)+ apply (clarsimp simp add: cap_rights_update_def acap_rights_update_def) apply (clarsimp simp: valid_cap_def cap_aligned_def pt_bits_def pageBits_def linorder_not_le
                           order_le_less_trans[OF word_and_le2]) apply (rule conjI) apply (clarsimp simp add: cte_wp_at_caps_of_state) apply (drule (1) caps_of_state_valid[rotated]) apply clarsimp apply (clarsimp simp: cap_master_cap_def is_arch_update_def) apply (clarsimp simp: cap_asid_def cap_rights_update_def acap_rights_update_def is_cap_simps
                    split: option.split) apply (rule conjI, fastforce) apply (rule conjI, fastforce) apply (clarsimp simp: pde_ref_def) apply (frule invs_pd_caps) apply (clarsimp simp: cte_wp_at_caps_of_state) apply (frule (1) caps_of_state_valid[rotated]) apply (clarsimp simp: cap_rights_update_def acap_rights_update_def valid_cap_def) apply (drule (2) valid_table_caps_ptD) apply (rule conjI, fastforce simp:)+ apply (clarsimp simp: kernel_vsrefs_def) apply (simp add: linorder_not_le, drule word_le_minus_one_leq) apply (drule le_shiftr[where n=20], drule(1) order_trans) apply (simp add: kernel_base_def) apply (simp add: valid_arch_inv_def valid_pti_def) apply (clarsimp simp: cte_wp_at_def is_cap_simps) apply (simp add: arch_decode_invocation_def Let_def) apply (cases "isPDFlushLabel (invocation_type label)") apply simp apply (rule hoare_pre) apply (wpsimp wp: whenE_throwError_wp hoare_weak_lift_imp hoare_drop_imp get_master_pte_wp
                      get_master_pde_wp whenE_throwError_wp
                simp: resolve_vaddr_def valid_arch_inv_def valid_pdi_def Let_def) apply (rule_tac Q'="\<lambda>pd' s. vspace_at_asid x2 pd' s \<and> x2 \<le> mask asid_bits \<and> x2 \<noteq> 0"
                 in hoare_post_imp_R) apply wpsimp+ apply (wpsimp wp: throwError_validE_R simp: valid_cap_def mask_def)+ done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>x11 x12. arch_cap = ASIDPoolCap x11 x12 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 2. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>word1 word2. arch_cap = ASIDPoolCap word1 word2 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 2. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>word1 word2. arch_cap = ASIDPoolCap word1 word2 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (ASIDPoolCap word1 word2)) and cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap word1 word2))) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> if invocation_type label = ArchInvocationLabel ARMASIDPoolAssign then if excaps \<noteq> [] then case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap xa None) \<Rightarrow> doE asid_table <- liftE $ gets (arm_asid_table \<circ> arch_state);
pool_ptr <- returnOk (asid_table (asid_high_bits_of word2));
whenE (pool_ptr = None) $ throwError $ FailedLookup False InvalidRoot;
whenE (word1 \<noteq> the pool_ptr) $ throwError $ InvalidCapability 0;
pool <- liftE $ get_asid_pool word1;
free_set <- returnOk (- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0});
whenE (free_set = {}) $ throwError DeleteFirst;
offset <- liftE $ select_ext (\<lambda>_. free_asid_pool_select pool word2) free_set;
returnOk $ InvokeASIDPool $ Assign (UCAST(10 \<rightarrow> 32) offset + word2) word1 (snd (excaps ! 0))
odE | ArchObjectCap (PageDirectoryCap xa (Some a)) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1 else throwError TruncatedMessage else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 2. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>word1 word2. arch_cap = ASIDPoolCap word1 word2 \<Longrightarrow> \<lbrace>?P'7 word1 word2\<rbrace> if invocation_type label = ArchInvocationLabel ARMASIDPoolAssign then if excaps \<noteq> [] then case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap xa None) \<Rightarrow> doE asid_table <- liftE $ gets (arm_asid_table \<circ> arch_state);
pool_ptr <- returnOk (asid_table (asid_high_bits_of word2));
whenE (pool_ptr = None) $ throwError $ FailedLookup False InvalidRoot;
whenE (word1 \<noteq> the pool_ptr) $ throwError $ InvalidCapability 0;
pool <- liftE $ get_asid_pool word1;
free_set <- returnOk (- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0});
whenE (free_set = {}) $ throwError DeleteFirst;
offset <- liftE $ select_ext (\<lambda>_. free_asid_pool_select pool word2) free_set;
returnOk $ InvokeASIDPool $ Assign (UCAST(10 \<rightarrow> 32) offset + word2) word1 (snd (excaps ! 0))
odE | ArchObjectCap (PageDirectoryCap xa (Some a)) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1 else throwError TruncatedMessage else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 2. \<And>word1 word2 s. \<lbrakk>arch_cap = ASIDPoolCap word1 word2; (invs and valid_cap (ArchObjectCap (ASIDPoolCap word1 word2)) and cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap word1 word2))) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)) s\<rbrakk> \<Longrightarrow> ?P'7 word1 word2 s
 3. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 6. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>word1 word2 s. \<lbrakk>arch_cap = ASIDPoolCap word1 word2; (invs and valid_cap (ArchObjectCap (ASIDPoolCap word1 word2)) and cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap word1 word2))) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)) s\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMASIDPoolAssign \<longrightarrow> (excaps \<noteq> [] \<longrightarrow> (fst (excaps ! 0) = NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. fst (excaps ! 0) = UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = EndpointCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = NotificationCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = CNodeCap x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ThreadCap x \<longrightarrow> True) \<and> (fst (excaps ! 0) = DomainCap \<longrightarrow> True) \<and> (fst (excaps ! 0) = IRQControlCap \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = ASIDPoolCap xa xb \<longrightarrow> True) \<and> (x = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>xa xb xc xd xe. x = PageCap xa xb xc xd xe \<longrightarrow> True) \<and> (\<forall>xa xb. x = PageTableCap xa xb \<longrightarrow> True) \<and> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (xb = None \<longrightarrow> True \<and> True \<and> True \<and> (if (arm_asid_table \<circ> arch_state) s (asid_high_bits_of word2) = None then \<lambda>s. True \<and> True else (\<lambda>a. \<not> word1 \<noteq> the ((arm_asid_table \<circ> arch_state) s (asid_high_bits_of word2)) \<longrightarrow> True \<and> (\<forall>pool. ako_at (ASIDPool pool) word1 a \<longrightarrow> - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {} \<longrightarrow> True \<and> (\<forall>x\<in>- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0}. valid_arch_inv (InvokeASIDPool (Assign (UCAST(10 \<rightarrow> 32) x + word2) word1 (snd (excaps ! 0)))) a)))) s) \<and> (\<forall>x. xb = Some x \<longrightarrow> True)))) \<and> (\<not> excaps \<noteq> [] \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMASIDPoolAssign \<longrightarrow> True)
 2. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>word1 word2 s. \<lbrakk>arch_cap = ASIDPoolCap word1 word2; invs s \<and> s \<turnstile> ArchObjectCap (ASIDPoolCap word1 word2) \<and> cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap word1 word2))) slot s \<and> (\<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrakk> \<Longrightarrow> (\<exists>y. asid_table s (asid_high_bits_of word2) = Some y) \<longrightarrow> invocation_type label = ArchInvocationLabel ARMASIDPoolAssign \<longrightarrow> excaps \<noteq> [] \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<exists>xa. x = PageDirectoryCap xa None) \<longrightarrow> word1 = the (asid_table s (asid_high_bits_of word2)) \<longrightarrow> (\<forall>pool. ako_at (ASIDPool pool) (the (asid_table s (asid_high_bits_of word2))) s \<longrightarrow> - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {} \<longrightarrow> (\<forall>x\<in>- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0}. (\<exists>pool. ako_at (ASIDPool pool) (the (asid_table s (asid_high_bits_of word2))) s \<and> pool (UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) x + word2)) = None) \<and> cte_wp_at (\<lambda>cap. is_pd_cap cap \<and> cap_asid cap = None) (snd (excaps ! 0)) s \<and> 0 < UCAST(10 \<rightarrow> 32) x + word2 \<and> UCAST(10 \<rightarrow> 32) x + word2 < 2 ^ local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (UCAST(10 \<rightarrow> 32) x + word2))) None] \<rhd> the (asid_table s (asid_high_bits_of word2))) s)))
 2. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>word1 word2 s x pool xa. \<lbrakk>arch_cap = ASIDPoolCap word1 word2; invs s \<and> s \<turnstile> ArchObjectCap (ASIDPoolCap word1 word2) \<and> cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap word1 word2))) slot s \<and> (\<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s); \<exists>y. asid_table s (asid_high_bits_of word2) = Some y; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap x; \<exists>xa. x = PageDirectoryCap xa None; word1 = the (asid_table s (asid_high_bits_of word2)); ako_at (ASIDPool pool) (the (asid_table s (asid_high_bits_of word2))) s; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; xa \<in> - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0}\<rbrakk> \<Longrightarrow> (\<exists>pool. ako_at (ASIDPool pool) (the (asid_table s (asid_high_bits_of word2))) s \<and> pool (UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) xa + word2)) = None) \<and> cte_wp_at (\<lambda>cap. is_pd_cap cap \<and> cap_asid cap = None) (snd (excaps ! 0)) s \<and> 0 < UCAST(10 \<rightarrow> 32) xa + word2 \<and> UCAST(10 \<rightarrow> 32) xa + word2 < 2 ^ local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (UCAST(10 \<rightarrow> 32) xa + word2))) None] \<rhd> the (asid_table s (asid_high_bits_of word2))) s
 2. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>word1 word2 s x pool xa y xb. \<lbrakk>arch_cap = ASIDPoolCap word1 word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap x; word1 = the (asid_table s (asid_high_bits_of word2)); ako_at (ASIDPool pool) (the (asid_table s (asid_high_bits_of word2))) s; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; xa \<in> - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0}; invs s; s \<turnstile> ArchObjectCap (ASIDPoolCap word1 word2); cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap word1 word2))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s; asid_table s (asid_high_bits_of word2) = Some y; x = PageDirectoryCap xb None\<rbrakk> \<Longrightarrow> (\<exists>pool. ako_at (ASIDPool pool) (the (asid_table s (asid_high_bits_of word2))) s \<and> pool (UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) xa + word2)) = None) \<and> cte_wp_at (\<lambda>cap. is_pd_cap cap \<and> cap_asid cap = None) (snd (excaps ! 0)) s \<and> 0 < UCAST(10 \<rightarrow> 32) xa + word2 \<and> UCAST(10 \<rightarrow> 32) xa + word2 < 2 ^ local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (UCAST(10 \<rightarrow> 32) xa + word2))) None] \<rhd> the (asid_table s (asid_high_bits_of word2))) s
 2. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>word1 word2 s x pool xa y xb. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xb None); word1 = y; ako_at (ASIDPool pool) y s; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; xa \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; invs s; s \<turnstile> ArchObjectCap (ASIDPoolCap y word2); cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s; asid_table s (asid_high_bits_of word2) = Some y; x = PageDirectoryCap xb None\<rbrakk> \<Longrightarrow> (\<exists>pool. ako_at (ASIDPool pool) y s \<and> pool (UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) xa + word2)) = None) \<and> cte_wp_at (\<lambda>cap. is_pd_cap cap \<and> cap_asid cap = None) (snd (excaps ! 0)) s \<and> 0 < UCAST(10 \<rightarrow> 32) xa + word2 \<and> UCAST(10 \<rightarrow> 32) xa + word2 < 2 ^ local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (UCAST(10 \<rightarrow> 32) xa + word2))) None] \<rhd> y) s
 2. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; s \<turnstile> ArchObjectCap (ASIDPoolCap y word2); cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; \<forall>x\<in>set ys. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> (\<exists>pool. ako_at (ASIDPool pool) y s \<and> pool (UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) xa + word2)) = None) \<and> cte_wp_at (\<lambda>cap. is_pd_cap cap \<and> cap_asid cap = None) (aa, b) s \<and> 0 < UCAST(10 \<rightarrow> 32) xa + word2 \<and> UCAST(10 \<rightarrow> 32) xa + word2 < 2 ^ local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (UCAST(10 \<rightarrow> 32) xa + word2))) None] \<rhd> y) s
 2. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; s \<turnstile> ArchObjectCap (ASIDPoolCap y word2); cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s\<rbrakk> \<Longrightarrow> (\<exists>pool. ako_at (ASIDPool pool) y s \<and> pool (UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) xa + word2)) = None) \<and> cte_wp_at (\<lambda>cap. is_pd_cap cap \<and> cap_asid cap = None) (aa, b) s \<and> 0 < UCAST(10 \<rightarrow> 32) xa + word2 \<and> UCAST(10 \<rightarrow> 32) xa + word2 < 2 ^ local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (UCAST(10 \<rightarrow> 32) xa + word2))) None] \<rhd> y) s
 2. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> (\<exists>pool. ako_at (ASIDPool pool) y s \<and> pool (UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) xa + word2)) = None) \<and> cte_wp_at (\<lambda>cap. is_pd_cap cap \<and> cap_asid cap = None) (aa, b) s \<and> 0 < UCAST(10 \<rightarrow> 32) xa + word2 \<and> UCAST(10 \<rightarrow> 32) xa + word2 < 2 ^ local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (UCAST(10 \<rightarrow> 32) xa + word2))) None] \<rhd> y) s
 2. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> \<exists>pool. ako_at (ASIDPool pool) y s \<and> pool (UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) xa + word2)) = None
 2. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>cap. is_pd_cap cap \<and> cap_asid cap = None) (aa, b) s \<and> 0 < UCAST(10 \<rightarrow> 32) xa + word2 \<and> UCAST(10 \<rightarrow> 32) xa + word2 < 2 ^ local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (UCAST(10 \<rightarrow> 32) xa + word2))) None] \<rhd> y) s
 3. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 6. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>word2 s xa y xb aa b ys ap. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; kheap s y = Some (ArchObj (ASIDPool ap)); - {a. \<exists>y. ap a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; ap xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> ap (UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) xa + word2)) = None
 2. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>cap. is_pd_cap cap \<and> cap_asid cap = None) (aa, b) s \<and> 0 < UCAST(10 \<rightarrow> 32) xa + word2 \<and> UCAST(10 \<rightarrow> 32) xa + word2 < 2 ^ local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (UCAST(10 \<rightarrow> 32) xa + word2))) None] \<rhd> y) s
 3. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 6. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (7 subgoals):
 1. \<And>word2 s xa y xb aa b ys ap. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; kheap s y = Some (ArchObj (ASIDPool ap)); - {a. \<exists>y. ap a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; ap xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) xa + word2) = xa\<rbrakk> \<Longrightarrow> ap (UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) xa + word2)) = None
 2. \<And>word2 s xa y xb aa b ys ap. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; kheap s y = Some (ArchObj (ASIDPool ap)); - {a. \<exists>y. ap a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; ap xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) xa + word2) = xa
 3. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>cap. is_pd_cap cap \<and> cap_asid cap = None) (aa, b) s \<and> 0 < UCAST(10 \<rightarrow> 32) xa + word2 \<and> UCAST(10 \<rightarrow> 32) xa + word2 < 2 ^ local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (UCAST(10 \<rightarrow> 32) xa + word2))) None] \<rhd> y) s
 4. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 6. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 7. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>word2 s xa y xb aa b ys ap. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; kheap s y = Some (ArchObj (ASIDPool ap)); - {a. \<exists>y. ap a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; ap xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) xa + word2) = xa
 2. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>cap. is_pd_cap cap \<and> cap_asid cap = None) (aa, b) s \<and> 0 < UCAST(10 \<rightarrow> 32) xa + word2 \<and> UCAST(10 \<rightarrow> 32) xa + word2 < 2 ^ local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (UCAST(10 \<rightarrow> 32) xa + word2))) None] \<rhd> y) s
 3. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 6. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>word2 s xa y xb aa b ys ap. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; kheap s y = Some (ArchObj (ASIDPool ap)); - {a. \<exists>y. ap a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; ap xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); \<forall>n<local.asid_low_bits. \<not> word2 !! n; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) xa + word2) = xa
 2. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>cap. is_pd_cap cap \<and> cap_asid cap = None) (aa, b) s \<and> 0 < UCAST(10 \<rightarrow> 32) xa + word2 \<and> UCAST(10 \<rightarrow> 32) xa + word2 < 2 ^ local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (UCAST(10 \<rightarrow> 32) xa + word2))) None] \<rhd> y) s
 3. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 6. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (7 subgoals):
 1. \<And>word2 s xa y xb aa b ys ap. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; kheap s y = Some (ArchObj (ASIDPool ap)); - {a. \<exists>y. ap a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; ap xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); \<forall>n<local.asid_low_bits. \<not> word2 !! n; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> UCAST(10 \<rightarrow> 32) xa && word2 = 0
 2. \<And>word2 s xa y xb aa b ys ap. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; kheap s y = Some (ArchObj (ASIDPool ap)); - {a. \<exists>y. ap a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; ap xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); \<forall>n<local.asid_low_bits. \<not> word2 !! n; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) xa || word2) = xa
 3. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>cap. is_pd_cap cap \<and> cap_asid cap = None) (aa, b) s \<and> 0 < UCAST(10 \<rightarrow> 32) xa + word2 \<and> UCAST(10 \<rightarrow> 32) xa + word2 < 2 ^ local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (UCAST(10 \<rightarrow> 32) xa + word2))) None] \<rhd> y) s
 4. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 6. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 7. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (7 subgoals):
 1. \<And>word2 s xa y xb aa b ys ap n. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; kheap s y = Some (ArchObj (ASIDPool ap)); - {a. \<exists>y. ap a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; ap xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); \<forall>n<local.asid_low_bits. \<not> word2 !! n; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> n < size (UCAST(10 \<rightarrow> 32) xa && word2) \<longrightarrow> (UCAST(10 \<rightarrow> 32) xa && word2) !! n = 0 !! n
 2. \<And>word2 s xa y xb aa b ys ap. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; kheap s y = Some (ArchObj (ASIDPool ap)); - {a. \<exists>y. ap a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; ap xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); \<forall>n<local.asid_low_bits. \<not> word2 !! n; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) xa || word2) = xa
 3. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>cap. is_pd_cap cap \<and> cap_asid cap = None) (aa, b) s \<and> 0 < UCAST(10 \<rightarrow> 32) xa + word2 \<and> UCAST(10 \<rightarrow> 32) xa + word2 < 2 ^ local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (UCAST(10 \<rightarrow> 32) xa + word2))) None] \<rhd> y) s
 4. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 6. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 7. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (7 subgoals):
 1. \<And>word2 s xa y xb aa b ys ap n. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; kheap s y = Some (ArchObj (ASIDPool ap)); - {a. \<exists>y. ap a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; ap xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); \<forall>n<local.asid_low_bits. \<not> word2 !! n; word2 < 2 ^ local.asid_bits; n < 32; xa !! n; word2 !! n\<rbrakk> \<Longrightarrow> False
 2. \<And>word2 s xa y xb aa b ys ap. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; kheap s y = Some (ArchObj (ASIDPool ap)); - {a. \<exists>y. ap a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; ap xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); \<forall>n<local.asid_low_bits. \<not> word2 !! n; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) xa || word2) = xa
 3. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>cap. is_pd_cap cap \<and> cap_asid cap = None) (aa, b) s \<and> 0 < UCAST(10 \<rightarrow> 32) xa + word2 \<and> UCAST(10 \<rightarrow> 32) xa + word2 < 2 ^ local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (UCAST(10 \<rightarrow> 32) xa + word2))) None] \<rhd> y) s
 4. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 6. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 7. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (7 subgoals):
 1. \<And>word2 s xa y xb aa b ys ap n. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; kheap s y = Some (ArchObj (ASIDPool ap)); - {a. \<exists>y. ap a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; ap xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); \<forall>n<local.asid_low_bits. \<not> word2 !! n; word2 < 2 ^ local.asid_bits; n < 32; word2 !! n; n < size xa\<rbrakk> \<Longrightarrow> False
 2. \<And>word2 s xa y xb aa b ys ap. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; kheap s y = Some (ArchObj (ASIDPool ap)); - {a. \<exists>y. ap a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; ap xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); \<forall>n<local.asid_low_bits. \<not> word2 !! n; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) xa || word2) = xa
 3. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>cap. is_pd_cap cap \<and> cap_asid cap = None) (aa, b) s \<and> 0 < UCAST(10 \<rightarrow> 32) xa + word2 \<and> UCAST(10 \<rightarrow> 32) xa + word2 < 2 ^ local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (UCAST(10 \<rightarrow> 32) xa + word2))) None] \<rhd> y) s
 4. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 6. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 7. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>word2 s xa y xb aa b ys ap. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; kheap s y = Some (ArchObj (ASIDPool ap)); - {a. \<exists>y. ap a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; ap xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); \<forall>n<local.asid_low_bits. \<not> word2 !! n; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) xa || word2) = xa
 2. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>cap. is_pd_cap cap \<and> cap_asid cap = None) (aa, b) s \<and> 0 < UCAST(10 \<rightarrow> 32) xa + word2 \<and> UCAST(10 \<rightarrow> 32) xa + word2 < 2 ^ local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (UCAST(10 \<rightarrow> 32) xa + word2))) None] \<rhd> y) s
 3. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 6. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>word2 s xa y xb aa b ys ap n. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; kheap s y = Some (ArchObj (ASIDPool ap)); - {a. \<exists>y. ap a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; ap xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); \<forall>n<local.asid_low_bits. \<not> word2 !! n; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> n < size (UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) xa || word2)) \<longrightarrow> UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) xa || word2) !! n = xa !! n
 2. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>cap. is_pd_cap cap \<and> cap_asid cap = None) (aa, b) s \<and> 0 < UCAST(10 \<rightarrow> 32) xa + word2 \<and> UCAST(10 \<rightarrow> 32) xa + word2 < 2 ^ local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (UCAST(10 \<rightarrow> 32) xa + word2))) None] \<rhd> y) s
 3. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 6. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>word2 s xa y xb aa b ys ap n. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; kheap s y = Some (ArchObj (ASIDPool ap)); - {a. \<exists>y. ap a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; ap xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); \<forall>n<local.asid_low_bits. \<not> word2 !! n; word2 < 2 ^ local.asid_bits; n < 10\<rbrakk> \<Longrightarrow> (xa !! n \<or> word2 !! n) = xa !! n
 2. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>cap. is_pd_cap cap \<and> cap_asid cap = None) (aa, b) s \<and> 0 < UCAST(10 \<rightarrow> 32) xa + word2 \<and> UCAST(10 \<rightarrow> 32) xa + word2 < 2 ^ local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (UCAST(10 \<rightarrow> 32) xa + word2))) None] \<rhd> y) s
 3. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 6. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>cap. is_pd_cap cap \<and> cap_asid cap = None) (aa, b) s \<and> 0 < UCAST(10 \<rightarrow> 32) xa + word2 \<and> UCAST(10 \<rightarrow> 32) xa + word2 < 2 ^ local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (UCAST(10 \<rightarrow> 32) xa + word2))) None] \<rhd> y) s
 2. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>cap. is_pd_cap cap \<and> cap_asid cap = None) (aa, b) s
 2. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> 0 < UCAST(10 \<rightarrow> 32) xa + word2 \<and> UCAST(10 \<rightarrow> 32) xa + word2 < 2 ^ local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (UCAST(10 \<rightarrow> 32) xa + word2))) None] \<rhd> y) s
 3. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 6. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; caps_of_state s slot = Some (ArchObjectCap (ASIDPoolCap y word2)); asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; caps_of_state s (aa, b) = Some (ArchObjectCap (PageDirectoryCap xb None)); cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> is_pd_cap (ArchObjectCap (PageDirectoryCap xb None))
 2. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> 0 < UCAST(10 \<rightarrow> 32) xa + word2 \<and> UCAST(10 \<rightarrow> 32) xa + word2 < 2 ^ local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (UCAST(10 \<rightarrow> 32) xa + word2))) None] \<rhd> y) s
 3. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 6. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>word2 s pool xa y xb aa c c'. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; caps_of_state s slot = Some (ArchObjectCap (ASIDPoolCap y word2)); asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, c) # c'; pool xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; caps_of_state s (aa, c) = Some (ArchObjectCap (PageDirectoryCap xb None)); cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> is_pd_cap (ArchObjectCap (PageDirectoryCap xb None))
 2. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> 0 < UCAST(10 \<rightarrow> 32) xa + word2 \<and> UCAST(10 \<rightarrow> 32) xa + word2 < 2 ^ local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (UCAST(10 \<rightarrow> 32) xa + word2))) None] \<rhd> y) s
 3. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 6. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>word2 s pool xa y xb aa c c'. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; caps_of_state s slot = Some (ArchObjectCap (ASIDPoolCap y word2)); asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, c) # c'; pool xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; caps_of_state s (aa, c) = Some (ArchObjectCap (PageDirectoryCap xb None)); cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; s \<turnstile> ArchObjectCap (PageDirectoryCap xb None)\<rbrakk> \<Longrightarrow> is_pd_cap (ArchObjectCap (PageDirectoryCap xb None))
 2. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> 0 < UCAST(10 \<rightarrow> 32) xa + word2 \<and> UCAST(10 \<rightarrow> 32) xa + word2 < 2 ^ local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (UCAST(10 \<rightarrow> 32) xa + word2))) None] \<rhd> y) s
 3. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 6. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. UCAST(10 \<rightarrow> 32) x + word2 \<noteq> 0} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; UCAST(10 \<rightarrow> 32) xa + word2 \<noteq> 0; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> 0 < UCAST(10 \<rightarrow> 32) xa + word2 \<and> UCAST(10 \<rightarrow> 32) xa + word2 < 2 ^ local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (UCAST(10 \<rightarrow> 32) xa + word2))) None] \<rhd> y) s
 2. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. 0 < UCAST(10 \<rightarrow> 32) x + word2} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; 0 < UCAST(10 \<rightarrow> 32) xa + word2; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> UCAST(10 \<rightarrow> 32) xa + word2 < 2 ^ local.asid_bits \<and> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (UCAST(10 \<rightarrow> 32) xa + word2))) None] \<rhd> y) s
 2. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. 0 < UCAST(10 \<rightarrow> 32) x + word2} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; 0 < UCAST(10 \<rightarrow> 32) xa + word2; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> UCAST(10 \<rightarrow> 32) xa + word2 < 2 ^ local.asid_bits
 2. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. 0 < UCAST(10 \<rightarrow> 32) x + word2} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; 0 < UCAST(10 \<rightarrow> 32) xa + word2; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (UCAST(10 \<rightarrow> 32) xa + word2))) None] \<rhd> y) s
 3. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 6. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (8 subgoals):
 1. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. 0 < UCAST(10 \<rightarrow> 32) x + word2} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; 0 < UCAST(10 \<rightarrow> 32) xa + word2; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> UCAST(10 \<rightarrow> 32) xa < 2 ^ local.asid_low_bits
 2. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. 0 < UCAST(10 \<rightarrow> 32) x + word2} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; 0 < UCAST(10 \<rightarrow> 32) xa + word2; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> local.asid_low_bits \<le> local.asid_bits
 3. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. 0 < UCAST(10 \<rightarrow> 32) x + word2} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; 0 < UCAST(10 \<rightarrow> 32) xa + word2; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> word2 < 2 ^ local.asid_bits
 4. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. 0 < UCAST(10 \<rightarrow> 32) x + word2} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; 0 < UCAST(10 \<rightarrow> 32) xa + word2; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (UCAST(10 \<rightarrow> 32) xa + word2))) None] \<rhd> y) s
 5. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 6. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 7. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 8. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (8 subgoals):
 1. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. 0 < UCAST(10 \<rightarrow> 32) x + word2} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; 0 < UCAST(10 \<rightarrow> 32) xa + word2; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> UCAST(10 \<rightarrow> 32) xa < 0x400
 2. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. 0 < UCAST(10 \<rightarrow> 32) x + word2} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; 0 < UCAST(10 \<rightarrow> 32) xa + word2; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> local.asid_low_bits \<le> local.asid_bits
 3. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. 0 < UCAST(10 \<rightarrow> 32) x + word2} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; 0 < UCAST(10 \<rightarrow> 32) xa + word2; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> word2 < 2 ^ local.asid_bits
 4. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. 0 < UCAST(10 \<rightarrow> 32) x + word2} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; 0 < UCAST(10 \<rightarrow> 32) xa + word2; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (UCAST(10 \<rightarrow> 32) xa + word2))) None] \<rhd> y) s
 5. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 6. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 7. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 8. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (7 subgoals):
 1. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. 0 < UCAST(10 \<rightarrow> 32) x + word2} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; 0 < UCAST(10 \<rightarrow> 32) xa + word2; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> local.asid_low_bits \<le> local.asid_bits
 2. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. 0 < UCAST(10 \<rightarrow> 32) x + word2} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; 0 < UCAST(10 \<rightarrow> 32) xa + word2; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> word2 < 2 ^ local.asid_bits
 3. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. 0 < UCAST(10 \<rightarrow> 32) x + word2} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; 0 < UCAST(10 \<rightarrow> 32) xa + word2; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (UCAST(10 \<rightarrow> 32) xa + word2))) None] \<rhd> y) s
 4. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 6. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 7. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. 0 < UCAST(10 \<rightarrow> 32) x + word2} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; 0 < UCAST(10 \<rightarrow> 32) xa + word2; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> word2 < 2 ^ local.asid_bits
 2. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. 0 < UCAST(10 \<rightarrow> 32) x + word2} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; 0 < UCAST(10 \<rightarrow> 32) xa + word2; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (UCAST(10 \<rightarrow> 32) xa + word2))) None] \<rhd> y) s
 3. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 6. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. 0 < UCAST(10 \<rightarrow> 32) x + word2} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; asid_table s (asid_high_bits_of word2) = Some y; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; 0 < UCAST(10 \<rightarrow> 32) xa + word2; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (UCAST(10 \<rightarrow> 32) xa + word2))) None] \<rhd> y) s
 2. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. 0 < UCAST(10 \<rightarrow> 32) x + word2} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; 0 < UCAST(10 \<rightarrow> 32) xa + word2; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2)) None] \<rhd> y) s\<rbrakk> \<Longrightarrow> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (UCAST(10 \<rightarrow> 32) xa + word2))) None] \<rhd> y) s
 2. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>word2 s pool xa y xb aa b ys. \<lbrakk>arch_cap = ASIDPoolCap y word2; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; ako_at (ASIDPool pool) y s; - {a. \<exists>y. pool a = Some y} \<inter> {x. 0 < UCAST(10 \<rightarrow> 32) x + word2} \<noteq> {}; invs s; cte_wp_at ((=) (ArchObjectCap (ASIDPoolCap y word2))) slot s; excaps = (ArchObjectCap (PageDirectoryCap xb None), aa, b) # ys; pool xa = None; 0 < UCAST(10 \<rightarrow> 32) xa + word2; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xb None))) (aa, b) s; cap_aligned (ArchObjectCap (ASIDPoolCap y word2)); typ_at (AArch AASIDPool) y s; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2)) None] \<rhd> y) s\<rbrakk> \<Longrightarrow> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2)) None] \<rhd> y) s
 2. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 2. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap ASIDControlCap) and cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> if invocation_type label = ArchInvocationLabel ARMASIDControlMakePool then if Suc 0 < length args \<and> Suc 0 < length excaps then doE asid_table <- liftE (gets (arm_asid_table \<circ> arch_state));
y <- whenE (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} = {}) (throwError DeleteFirst);
free <- liftE (select_ext (\<lambda>_. free_asid_select asid_table) (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1}));
p <- case fst (excaps ! 0) of UntypedCap True p n f \<Rightarrow> throwError $ InvalidCapability 1 | UntypedCap False p n f \<Rightarrow> returnOk (p, n) | _ \<Rightarrow> throwError $ InvalidCapability 1;
frame <- if snd p = pageBits then doE y <- ensure_no_children (snd (excaps ! 0));
returnOk (fst p)
odE else throwError (InvalidCapability (Suc 0));
dest_slot <- lookup_target_slot (fst (excaps ! Suc 0)) (to_bl (args ! 0)) (unat (args ! Suc 0));
y <- ensure_empty dest_slot;
returnOk (InvokeASIDControl (MakePool frame dest_slot (snd (excaps ! 0)) (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits)))
odE else throwError TruncatedMessage else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 2. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. arch_cap = ASIDControlCap \<Longrightarrow> \<lbrace>?P'375\<rbrace> if invocation_type label = ArchInvocationLabel ARMASIDControlMakePool then if Suc 0 < length args \<and> Suc 0 < length excaps then doE asid_table <- liftE (gets (arm_asid_table \<circ> arch_state));
y <- whenE (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} = {}) (throwError DeleteFirst);
free <- liftE (select_ext (\<lambda>_. free_asid_select asid_table) (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1}));
p <- case fst (excaps ! 0) of UntypedCap True p n f \<Rightarrow> throwError $ InvalidCapability 1 | UntypedCap False p n f \<Rightarrow> returnOk (p, n) | _ \<Rightarrow> throwError $ InvalidCapability 1;
frame <- if snd p = pageBits then doE y <- ensure_no_children (snd (excaps ! 0));
returnOk (fst p)
odE else throwError (InvalidCapability (Suc 0));
dest_slot <- lookup_target_slot (fst (excaps ! Suc 0)) (to_bl (args ! 0)) (unat (args ! Suc 0));
y <- ensure_empty dest_slot;
returnOk (InvokeASIDControl (MakePool frame dest_slot (snd (excaps ! 0)) (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits)))
odE else throwError TruncatedMessage else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 2. \<And>s. \<lbrakk>arch_cap = ASIDControlCap; (invs and valid_cap (ArchObjectCap ASIDControlCap) and cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)) s\<rbrakk> \<Longrightarrow> ?P'375 s
 3. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (12 subgoals):
 1. \<And>asid_tablea free p frame. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?P'395 asid_tablea () free p frame\<rbrace> lookup_target_slot (fst (excaps ! Suc 0)) (to_bl (args ! 0)) (unat (args ! Suc 0)) \<lbrace>\<lambda>rv s. cte_wp_at (\<lambda>c. c = NullCap) rv s \<longrightarrow> real_cte_at rv s \<and> ex_cte_cap_wp_to is_cnode_cap rv s \<and> rv \<noteq> snd (excaps ! 0) \<and> cte_wp_at (\<lambda>cap. \<exists>idx. cap = UntypedCap False frame pageBits idx) (snd (excaps ! 0)) s \<and> descendants_of (snd (excaps ! 0)) (cdt s) = {} \<and> UCAST(7 \<rightarrow> 32) free << local.asid_low_bits < 2 ^ local.asid_bits \<and> asid_table s free = None\<rbrace>, -
 2. \<And>asid_table y free p. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B384 asid_table y free p\<rbrace> if snd p = pageBits then doE y <- ensure_no_children (snd (excaps ! 0));
returnOk (fst p)
odE else throwError (InvalidCapability (Suc 0)) \<lbrace>\<lambda>frame s. True \<and> True \<and> ?P'395 asid_table y free p frame s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>asid_table y free. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B383 asid_table y free\<rbrace> case fst (excaps ! 0) of UntypedCap True p n f \<Rightarrow> throwError $ InvalidCapability 1 | UntypedCap False p n f \<Rightarrow> returnOk (p, n) | _ \<Rightarrow> throwError $ InvalidCapability 1 \<lbrace>?B384 asid_table y free\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>asid_table y. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B382 asid_table y\<rbrace> liftE (select_ext (\<lambda>_. free_asid_select asid_table) (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1})) \<lbrace>?B383 asid_table y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>asid_table. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B381 asid_table\<rbrace> whenE (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} = {}) (throwError DeleteFirst) \<lbrace>?B382 asid_table\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?Qa380\<rbrace> liftE (gets (arm_asid_table \<circ> arch_state)) \<lbrace>?B381\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; \<not> (Suc 0 < length args \<and> Suc 0 < length excaps)\<rbrakk> \<Longrightarrow> \<lbrace>?R380\<rbrace> throwError TruncatedMessage \<lbrace>valid_arch_inv\<rbrace>, -
 8. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label \<noteq> ArchInvocationLabel ARMASIDControlMakePool\<rbrakk> \<Longrightarrow> \<lbrace>?R379\<rbrace> throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 9. \<And>s. \<lbrakk>arch_cap = ASIDControlCap; (invs and valid_cap (ArchObjectCap ASIDControlCap) and cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)) s\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> (Suc 0 < length args \<and> Suc 0 < length excaps \<longrightarrow> ?Qa380 s) \<and> (\<not> (Suc 0 < length args \<and> Suc 0 < length excaps) \<longrightarrow> ?R380 s)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> ?R379 s)
 10. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>asid_tablea free p frame. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?P'395 asid_tablea () free p frame\<rbrace> lookup_target_slot (fst (excaps ! Suc 0)) (to_bl (args ! 0)) (unat (args ! Suc 0)) \<lbrace>\<lambda>rv. real_cte_at rv and ex_cte_cap_wp_to is_cnode_cap rv and (\<lambda>s. descendants_of (snd (excaps ! 0)) (cdt s) = {}) and cte_wp_at (\<lambda>c. \<exists>idx. c = UntypedCap False frame pageBits idx) (snd (excaps ! 0)) and (\<lambda>s. asid_table s free = None)\<rbrace>, -
 2. \<And>asid_tablea free p frame rv s. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; (real_cte_at rv and ex_cte_cap_wp_to is_cnode_cap rv and (\<lambda>s. descendants_of (snd (excaps ! 0)) (cdt s) = {}) and cte_wp_at (\<lambda>c. \<exists>idx. c = UntypedCap False frame pageBits idx) (snd (excaps ! 0)) and (\<lambda>s. asid_table s free = None)) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. c = NullCap) rv s \<longrightarrow> real_cte_at rv s \<and> ex_cte_cap_wp_to is_cnode_cap rv s \<and> rv \<noteq> snd (excaps ! 0) \<and> cte_wp_at (\<lambda>cap. \<exists>idx. cap = UntypedCap False frame pageBits idx) (snd (excaps ! 0)) s \<and> descendants_of (snd (excaps ! 0)) (cdt s) = {} \<and> UCAST(7 \<rightarrow> 32) free << local.asid_low_bits < 2 ^ local.asid_bits \<and> asid_table s free = None
 3. \<And>asid_table y free p. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B384 asid_table y free p\<rbrace> if snd p = pageBits then doE y <- ensure_no_children (snd (excaps ! 0));
returnOk (fst p)
odE else throwError (InvalidCapability (Suc 0)) \<lbrace>\<lambda>frame s. True \<and> True \<and> ?P'395 asid_table y free p frame s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>asid_table y free. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B383 asid_table y free\<rbrace> case fst (excaps ! 0) of UntypedCap True p n f \<Rightarrow> throwError $ InvalidCapability 1 | UntypedCap False p n f \<Rightarrow> returnOk (p, n) | _ \<Rightarrow> throwError $ InvalidCapability 1 \<lbrace>?B384 asid_table y free\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>asid_table y. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B382 asid_table y\<rbrace> liftE (select_ext (\<lambda>_. free_asid_select asid_table) (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1})) \<lbrace>?B383 asid_table y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>asid_table. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B381 asid_table\<rbrace> whenE (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} = {}) (throwError DeleteFirst) \<lbrace>?B382 asid_table\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?Qa380\<rbrace> liftE (gets (arm_asid_table \<circ> arch_state)) \<lbrace>?B381\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; \<not> (Suc 0 < length args \<and> Suc 0 < length excaps)\<rbrakk> \<Longrightarrow> \<lbrace>?R380\<rbrace> throwError TruncatedMessage \<lbrace>valid_arch_inv\<rbrace>, -
 9. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label \<noteq> ArchInvocationLabel ARMASIDControlMakePool\<rbrakk> \<Longrightarrow> \<lbrace>?R379\<rbrace> throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 10. \<And>s. \<lbrakk>arch_cap = ASIDControlCap; (invs and valid_cap (ArchObjectCap ASIDControlCap) and cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)) s\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> (Suc 0 < length args \<and> Suc 0 < length excaps \<longrightarrow> ?Qa380 s) \<and> (\<not> (Suc 0 < length args \<and> Suc 0 < length excaps) \<longrightarrow> ?R380 s)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> ?R379 s)
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>asid_tablea free p frame. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?P'395 asid_tablea () free p frame\<rbrace> lookup_slot_for_cnode_op False (fst (excaps ! Suc 0)) (to_bl (args ! 0)) (unat (args ! Suc 0)) \<lbrace>\<lambda>rv. real_cte_at rv and ex_cte_cap_wp_to is_cnode_cap rv and (\<lambda>s. descendants_of (snd (excaps ! 0)) (cdt s) = {}) and cte_wp_at (\<lambda>c. \<exists>idx. c = UntypedCap False frame pageBits idx) (snd (excaps ! 0)) and (\<lambda>s. asid_table s free = None)\<rbrace>, -
 2. \<And>asid_tablea free p frame rv s. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; (real_cte_at rv and ex_cte_cap_wp_to is_cnode_cap rv and (\<lambda>s. descendants_of (snd (excaps ! 0)) (cdt s) = {}) and cte_wp_at (\<lambda>c. \<exists>idx. c = UntypedCap False frame pageBits idx) (snd (excaps ! 0)) and (\<lambda>s. asid_table s free = None)) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. c = NullCap) rv s \<longrightarrow> real_cte_at rv s \<and> ex_cte_cap_wp_to is_cnode_cap rv s \<and> rv \<noteq> snd (excaps ! 0) \<and> cte_wp_at (\<lambda>cap. \<exists>idx. cap = UntypedCap False frame pageBits idx) (snd (excaps ! 0)) s \<and> descendants_of (snd (excaps ! 0)) (cdt s) = {} \<and> UCAST(7 \<rightarrow> 32) free << local.asid_low_bits < 2 ^ local.asid_bits \<and> asid_table s free = None
 3. \<And>asid_table y free p. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B384 asid_table y free p\<rbrace> if snd p = pageBits then doE y <- ensure_no_children (snd (excaps ! 0));
returnOk (fst p)
odE else throwError (InvalidCapability (Suc 0)) \<lbrace>\<lambda>frame s. True \<and> True \<and> ?P'395 asid_table y free p frame s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>asid_table y free. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B383 asid_table y free\<rbrace> case fst (excaps ! 0) of UntypedCap True p n f \<Rightarrow> throwError $ InvalidCapability 1 | UntypedCap False p n f \<Rightarrow> returnOk (p, n) | _ \<Rightarrow> throwError $ InvalidCapability 1 \<lbrace>?B384 asid_table y free\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>asid_table y. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B382 asid_table y\<rbrace> liftE (select_ext (\<lambda>_. free_asid_select asid_table) (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1})) \<lbrace>?B383 asid_table y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>asid_table. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B381 asid_table\<rbrace> whenE (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} = {}) (throwError DeleteFirst) \<lbrace>?B382 asid_table\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?Qa380\<rbrace> liftE (gets (arm_asid_table \<circ> arch_state)) \<lbrace>?B381\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; \<not> (Suc 0 < length args \<and> Suc 0 < length excaps)\<rbrakk> \<Longrightarrow> \<lbrace>?R380\<rbrace> throwError TruncatedMessage \<lbrace>valid_arch_inv\<rbrace>, -
 9. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label \<noteq> ArchInvocationLabel ARMASIDControlMakePool\<rbrakk> \<Longrightarrow> \<lbrace>?R379\<rbrace> throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 10. \<And>s. \<lbrakk>arch_cap = ASIDControlCap; (invs and valid_cap (ArchObjectCap ASIDControlCap) and cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)) s\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> (Suc 0 < length args \<and> Suc 0 < length excaps \<longrightarrow> ?Qa380 s) \<and> (\<not> (Suc 0 < length args \<and> Suc 0 < length excaps) \<longrightarrow> ?R380 s)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> ?R379 s)
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>asid_tablea free p frame rv s. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; (real_cte_at rv and ex_cte_cap_wp_to is_cnode_cap rv and (\<lambda>s. descendants_of (snd (excaps ! 0)) (cdt s) = {}) and cte_wp_at (\<lambda>c. \<exists>idx. c = UntypedCap False frame pageBits idx) (snd (excaps ! 0)) and (\<lambda>s. asid_table s free = None)) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. c = NullCap) rv s \<longrightarrow> real_cte_at rv s \<and> ex_cte_cap_wp_to is_cnode_cap rv s \<and> rv \<noteq> snd (excaps ! 0) \<and> cte_wp_at (\<lambda>cap. \<exists>idx. cap = UntypedCap False frame pageBits idx) (snd (excaps ! 0)) s \<and> descendants_of (snd (excaps ! 0)) (cdt s) = {} \<and> UCAST(7 \<rightarrow> 32) free << local.asid_low_bits < 2 ^ local.asid_bits \<and> asid_table s free = None
 2. \<And>asid_tablea y free p. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B384 asid_tablea y free p\<rbrace> if snd p = pageBits then doE y <- ensure_no_children (snd (excaps ! 0));
returnOk (fst p)
odE else throwError (InvalidCapability (Suc 0)) \<lbrace>\<lambda>frame s. True \<and> True \<and> (valid_objs and (\<lambda>a. a \<turnstile> fst (excaps ! Suc 0))) s \<and> ((is_cnode_cap (fst (excaps ! Suc 0)) \<longrightarrow> (\<forall>r\<in>cte_refs (fst (excaps ! Suc 0)) (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cp. is_cnode_cap cp \<longrightarrow> is_cnode_cap cp)) \<and> descendants_of (snd (excaps ! 0)) (cdt s) = {} \<and> cte_wp_at (\<lambda>c. \<exists>idx. c = UntypedCap False frame pageBits idx) (snd (excaps ! 0)) s \<and> asid_table s free = None\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>asid_table y free. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B383 asid_table y free\<rbrace> case fst (excaps ! 0) of UntypedCap True p n f \<Rightarrow> throwError $ InvalidCapability 1 | UntypedCap False p n f \<Rightarrow> returnOk (p, n) | _ \<Rightarrow> throwError $ InvalidCapability 1 \<lbrace>?B384 asid_table y free\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>asid_table y. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B382 asid_table y\<rbrace> liftE (select_ext (\<lambda>_. free_asid_select asid_table) (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1})) \<lbrace>?B383 asid_table y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>asid_table. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B381 asid_table\<rbrace> whenE (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} = {}) (throwError DeleteFirst) \<lbrace>?B382 asid_table\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?Qa380\<rbrace> liftE (gets (arm_asid_table \<circ> arch_state)) \<lbrace>?B381\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; \<not> (Suc 0 < length args \<and> Suc 0 < length excaps)\<rbrakk> \<Longrightarrow> \<lbrace>?R380\<rbrace> throwError TruncatedMessage \<lbrace>valid_arch_inv\<rbrace>, -
 8. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label \<noteq> ArchInvocationLabel ARMASIDControlMakePool\<rbrakk> \<Longrightarrow> \<lbrace>?R379\<rbrace> throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 9. \<And>s. \<lbrakk>arch_cap = ASIDControlCap; (invs and valid_cap (ArchObjectCap ASIDControlCap) and cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)) s\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> (Suc 0 < length args \<and> Suc 0 < length excaps \<longrightarrow> ?Qa380 s) \<and> (\<not> (Suc 0 < length args \<and> Suc 0 < length excaps) \<longrightarrow> ?R380 s)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> ?R379 s)
 10. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>free frame a b s idx. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args; Suc 0 < length excaps; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; descendants_of (snd (excaps ! 0)) (cdt s) = {}; asid_table s free = None; fst (get_cap (snd (excaps ! 0)) s) = {(UntypedCap False frame pageBits idx, s)}; fst (get_cap (a, b) s) = {(NullCap, s)}\<rbrakk> \<Longrightarrow> (a, b) \<noteq> snd (excaps ! 0) \<and> UCAST(7 \<rightarrow> 32) free << local.asid_low_bits < 2 ^ local.asid_bits
 2. \<And>asid_tablea y free p. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B384 asid_tablea y free p\<rbrace> if snd p = pageBits then doE y <- ensure_no_children (snd (excaps ! 0));
returnOk (fst p)
odE else throwError (InvalidCapability (Suc 0)) \<lbrace>\<lambda>frame s. True \<and> True \<and> (valid_objs and (\<lambda>a. a \<turnstile> fst (excaps ! Suc 0))) s \<and> ((is_cnode_cap (fst (excaps ! Suc 0)) \<longrightarrow> (\<forall>r\<in>cte_refs (fst (excaps ! Suc 0)) (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cp. is_cnode_cap cp \<longrightarrow> is_cnode_cap cp)) \<and> descendants_of (snd (excaps ! 0)) (cdt s) = {} \<and> cte_wp_at (\<lambda>c. \<exists>idx. c = UntypedCap False frame pageBits idx) (snd (excaps ! 0)) s \<and> asid_table s free = None\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>asid_table y free. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B383 asid_table y free\<rbrace> case fst (excaps ! 0) of UntypedCap True p n f \<Rightarrow> throwError $ InvalidCapability 1 | UntypedCap False p n f \<Rightarrow> returnOk (p, n) | _ \<Rightarrow> throwError $ InvalidCapability 1 \<lbrace>?B384 asid_table y free\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>asid_table y. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B382 asid_table y\<rbrace> liftE (select_ext (\<lambda>_. free_asid_select asid_table) (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1})) \<lbrace>?B383 asid_table y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>asid_table. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B381 asid_table\<rbrace> whenE (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} = {}) (throwError DeleteFirst) \<lbrace>?B382 asid_table\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?Qa380\<rbrace> liftE (gets (arm_asid_table \<circ> arch_state)) \<lbrace>?B381\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; \<not> (Suc 0 < length args \<and> Suc 0 < length excaps)\<rbrakk> \<Longrightarrow> \<lbrace>?R380\<rbrace> throwError TruncatedMessage \<lbrace>valid_arch_inv\<rbrace>, -
 8. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label \<noteq> ArchInvocationLabel ARMASIDControlMakePool\<rbrakk> \<Longrightarrow> \<lbrace>?R379\<rbrace> throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 9. \<And>s. \<lbrakk>arch_cap = ASIDControlCap; (invs and valid_cap (ArchObjectCap ASIDControlCap) and cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)) s\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> (Suc 0 < length args \<and> Suc 0 < length excaps \<longrightarrow> ?Qa380 s) \<and> (\<not> (Suc 0 < length args \<and> Suc 0 < length excaps) \<longrightarrow> ?R380 s)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> ?R379 s)
 10. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>free frame a b s idx. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args; Suc 0 < length excaps; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; descendants_of (snd (excaps ! 0)) (cdt s) = {}; asid_table s free = None; fst (get_cap (snd (excaps ! 0)) s) = {(UntypedCap False frame pageBits idx, s)}; fst (get_cap (a, b) s) = {(NullCap, s)}\<rbrakk> \<Longrightarrow> UCAST(7 \<rightarrow> 32) free << local.asid_low_bits < 2 ^ local.asid_bits
 2. \<And>asid_tablea y free p. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B384 asid_tablea y free p\<rbrace> if snd p = pageBits then doE y <- ensure_no_children (snd (excaps ! 0));
returnOk (fst p)
odE else throwError (InvalidCapability (Suc 0)) \<lbrace>\<lambda>frame s. True \<and> True \<and> (valid_objs and (\<lambda>a. a \<turnstile> fst (excaps ! Suc 0))) s \<and> ((is_cnode_cap (fst (excaps ! Suc 0)) \<longrightarrow> (\<forall>r\<in>cte_refs (fst (excaps ! Suc 0)) (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cp. is_cnode_cap cp \<longrightarrow> is_cnode_cap cp)) \<and> descendants_of (snd (excaps ! 0)) (cdt s) = {} \<and> cte_wp_at (\<lambda>c. \<exists>idx. c = UntypedCap False frame pageBits idx) (snd (excaps ! 0)) s \<and> asid_table s free = None\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>asid_table y free. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B383 asid_table y free\<rbrace> case fst (excaps ! 0) of UntypedCap True p n f \<Rightarrow> throwError $ InvalidCapability 1 | UntypedCap False p n f \<Rightarrow> returnOk (p, n) | _ \<Rightarrow> throwError $ InvalidCapability 1 \<lbrace>?B384 asid_table y free\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>asid_table y. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B382 asid_table y\<rbrace> liftE (select_ext (\<lambda>_. free_asid_select asid_table) (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1})) \<lbrace>?B383 asid_table y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>asid_table. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B381 asid_table\<rbrace> whenE (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} = {}) (throwError DeleteFirst) \<lbrace>?B382 asid_table\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?Qa380\<rbrace> liftE (gets (arm_asid_table \<circ> arch_state)) \<lbrace>?B381\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; \<not> (Suc 0 < length args \<and> Suc 0 < length excaps)\<rbrakk> \<Longrightarrow> \<lbrace>?R380\<rbrace> throwError TruncatedMessage \<lbrace>valid_arch_inv\<rbrace>, -
 8. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label \<noteq> ArchInvocationLabel ARMASIDControlMakePool\<rbrakk> \<Longrightarrow> \<lbrace>?R379\<rbrace> throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 9. \<And>s. \<lbrakk>arch_cap = ASIDControlCap; (invs and valid_cap (ArchObjectCap ASIDControlCap) and cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)) s\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> (Suc 0 < length args \<and> Suc 0 < length excaps \<longrightarrow> ?Qa380 s) \<and> (\<not> (Suc 0 < length args \<and> Suc 0 < length excaps) \<longrightarrow> ?R380 s)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> ?R379 s)
 10. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>free frame a b s idx. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args; Suc 0 < length excaps; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; descendants_of (snd (excaps ! 0)) (cdt s) = {}; asid_table s free = None; fst (get_cap (snd (excaps ! 0)) s) = {(UntypedCap False frame pageBits idx, s)}; fst (get_cap (a, b) s) = {(NullCap, s)}\<rbrakk> \<Longrightarrow> UCAST(7 \<rightarrow> 32) free < 2 ^ (local.asid_bits - local.asid_low_bits)
 2. \<And>free frame a b s idx. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args; Suc 0 < length excaps; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; descendants_of (snd (excaps ! 0)) (cdt s) = {}; asid_table s free = None; fst (get_cap (snd (excaps ! 0)) s) = {(UntypedCap False frame pageBits idx, s)}; fst (get_cap (a, b) s) = {(NullCap, s)}\<rbrakk> \<Longrightarrow> local.asid_bits < LENGTH(32)
 3. \<And>asid_tablea y free p. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B384 asid_tablea y free p\<rbrace> if snd p = pageBits then doE y <- ensure_no_children (snd (excaps ! 0));
returnOk (fst p)
odE else throwError (InvalidCapability (Suc 0)) \<lbrace>\<lambda>frame s. True \<and> True \<and> (valid_objs and (\<lambda>a. a \<turnstile> fst (excaps ! Suc 0))) s \<and> ((is_cnode_cap (fst (excaps ! Suc 0)) \<longrightarrow> (\<forall>r\<in>cte_refs (fst (excaps ! Suc 0)) (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cp. is_cnode_cap cp \<longrightarrow> is_cnode_cap cp)) \<and> descendants_of (snd (excaps ! 0)) (cdt s) = {} \<and> cte_wp_at (\<lambda>c. \<exists>idx. c = UntypedCap False frame pageBits idx) (snd (excaps ! 0)) s \<and> asid_table s free = None\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>asid_table y free. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B383 asid_table y free\<rbrace> case fst (excaps ! 0) of UntypedCap True p n f \<Rightarrow> throwError $ InvalidCapability 1 | UntypedCap False p n f \<Rightarrow> returnOk (p, n) | _ \<Rightarrow> throwError $ InvalidCapability 1 \<lbrace>?B384 asid_table y free\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>asid_table y. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B382 asid_table y\<rbrace> liftE (select_ext (\<lambda>_. free_asid_select asid_table) (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1})) \<lbrace>?B383 asid_table y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>asid_table. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B381 asid_table\<rbrace> whenE (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} = {}) (throwError DeleteFirst) \<lbrace>?B382 asid_table\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?Qa380\<rbrace> liftE (gets (arm_asid_table \<circ> arch_state)) \<lbrace>?B381\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; \<not> (Suc 0 < length args \<and> Suc 0 < length excaps)\<rbrakk> \<Longrightarrow> \<lbrace>?R380\<rbrace> throwError TruncatedMessage \<lbrace>valid_arch_inv\<rbrace>, -
 9. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label \<noteq> ArchInvocationLabel ARMASIDControlMakePool\<rbrakk> \<Longrightarrow> \<lbrace>?R379\<rbrace> throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 10. \<And>s. \<lbrakk>arch_cap = ASIDControlCap; (invs and valid_cap (ArchObjectCap ASIDControlCap) and cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)) s\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> (Suc 0 < length args \<and> Suc 0 < length excaps \<longrightarrow> ?Qa380 s) \<and> (\<not> (Suc 0 < length args \<and> Suc 0 < length excaps) \<longrightarrow> ?R380 s)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> ?R379 s)
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>free frame a b s idx. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args; Suc 0 < length excaps; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; descendants_of (snd (excaps ! 0)) (cdt s) = {}; asid_table s free = None; fst (get_cap (snd (excaps ! 0)) s) = {(UntypedCap False frame pageBits idx, s)}; fst (get_cap (a, b) s) = {(NullCap, s)}\<rbrakk> \<Longrightarrow> 2 ^ LENGTH(7) \<le> 2 ^ (local.asid_bits - local.asid_low_bits)
 2. \<And>free frame a b s idx. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args; Suc 0 < length excaps; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; descendants_of (snd (excaps ! 0)) (cdt s) = {}; asid_table s free = None; fst (get_cap (snd (excaps ! 0)) s) = {(UntypedCap False frame pageBits idx, s)}; fst (get_cap (a, b) s) = {(NullCap, s)}\<rbrakk> \<Longrightarrow> local.asid_bits < LENGTH(32)
 3. \<And>asid_tablea y free p. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B384 asid_tablea y free p\<rbrace> if snd p = pageBits then doE y <- ensure_no_children (snd (excaps ! 0));
returnOk (fst p)
odE else throwError (InvalidCapability (Suc 0)) \<lbrace>\<lambda>frame s. True \<and> True \<and> (valid_objs and (\<lambda>a. a \<turnstile> fst (excaps ! Suc 0))) s \<and> ((is_cnode_cap (fst (excaps ! Suc 0)) \<longrightarrow> (\<forall>r\<in>cte_refs (fst (excaps ! Suc 0)) (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cp. is_cnode_cap cp \<longrightarrow> is_cnode_cap cp)) \<and> descendants_of (snd (excaps ! 0)) (cdt s) = {} \<and> cte_wp_at (\<lambda>c. \<exists>idx. c = UntypedCap False frame pageBits idx) (snd (excaps ! 0)) s \<and> asid_table s free = None\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>asid_table y free. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B383 asid_table y free\<rbrace> case fst (excaps ! 0) of UntypedCap True p n f \<Rightarrow> throwError $ InvalidCapability 1 | UntypedCap False p n f \<Rightarrow> returnOk (p, n) | _ \<Rightarrow> throwError $ InvalidCapability 1 \<lbrace>?B384 asid_table y free\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>asid_table y. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B382 asid_table y\<rbrace> liftE (select_ext (\<lambda>_. free_asid_select asid_table) (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1})) \<lbrace>?B383 asid_table y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>asid_table. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B381 asid_table\<rbrace> whenE (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} = {}) (throwError DeleteFirst) \<lbrace>?B382 asid_table\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?Qa380\<rbrace> liftE (gets (arm_asid_table \<circ> arch_state)) \<lbrace>?B381\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; \<not> (Suc 0 < length args \<and> Suc 0 < length excaps)\<rbrakk> \<Longrightarrow> \<lbrace>?R380\<rbrace> throwError TruncatedMessage \<lbrace>valid_arch_inv\<rbrace>, -
 9. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label \<noteq> ArchInvocationLabel ARMASIDControlMakePool\<rbrakk> \<Longrightarrow> \<lbrace>?R379\<rbrace> throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 10. \<And>s. \<lbrakk>arch_cap = ASIDControlCap; (invs and valid_cap (ArchObjectCap ASIDControlCap) and cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)) s\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> (Suc 0 < length args \<and> Suc 0 < length excaps \<longrightarrow> ?Qa380 s) \<and> (\<not> (Suc 0 < length args \<and> Suc 0 < length excaps) \<longrightarrow> ?R380 s)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> ?R379 s)
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>free frame a b s idx. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args; Suc 0 < length excaps; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; descendants_of (snd (excaps ! 0)) (cdt s) = {}; asid_table s free = None; fst (get_cap (snd (excaps ! 0)) s) = {(UntypedCap False frame pageBits idx, s)}; fst (get_cap (a, b) s) = {(NullCap, s)}\<rbrakk> \<Longrightarrow> local.asid_bits < LENGTH(32)
 2. \<And>asid_tablea y free p. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B384 asid_tablea y free p\<rbrace> if snd p = pageBits then doE y <- ensure_no_children (snd (excaps ! 0));
returnOk (fst p)
odE else throwError (InvalidCapability (Suc 0)) \<lbrace>\<lambda>frame s. True \<and> True \<and> (valid_objs and (\<lambda>a. a \<turnstile> fst (excaps ! Suc 0))) s \<and> ((is_cnode_cap (fst (excaps ! Suc 0)) \<longrightarrow> (\<forall>r\<in>cte_refs (fst (excaps ! Suc 0)) (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cp. is_cnode_cap cp \<longrightarrow> is_cnode_cap cp)) \<and> descendants_of (snd (excaps ! 0)) (cdt s) = {} \<and> cte_wp_at (\<lambda>c. \<exists>idx. c = UntypedCap False frame pageBits idx) (snd (excaps ! 0)) s \<and> asid_table s free = None\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>asid_table y free. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B383 asid_table y free\<rbrace> case fst (excaps ! 0) of UntypedCap True p n f \<Rightarrow> throwError $ InvalidCapability 1 | UntypedCap False p n f \<Rightarrow> returnOk (p, n) | _ \<Rightarrow> throwError $ InvalidCapability 1 \<lbrace>?B384 asid_table y free\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>asid_table y. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B382 asid_table y\<rbrace> liftE (select_ext (\<lambda>_. free_asid_select asid_table) (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1})) \<lbrace>?B383 asid_table y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>asid_table. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B381 asid_table\<rbrace> whenE (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} = {}) (throwError DeleteFirst) \<lbrace>?B382 asid_table\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?Qa380\<rbrace> liftE (gets (arm_asid_table \<circ> arch_state)) \<lbrace>?B381\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; \<not> (Suc 0 < length args \<and> Suc 0 < length excaps)\<rbrakk> \<Longrightarrow> \<lbrace>?R380\<rbrace> throwError TruncatedMessage \<lbrace>valid_arch_inv\<rbrace>, -
 8. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label \<noteq> ArchInvocationLabel ARMASIDControlMakePool\<rbrakk> \<Longrightarrow> \<lbrace>?R379\<rbrace> throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 9. \<And>s. \<lbrakk>arch_cap = ASIDControlCap; (invs and valid_cap (ArchObjectCap ASIDControlCap) and cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)) s\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> (Suc 0 < length args \<and> Suc 0 < length excaps \<longrightarrow> ?Qa380 s) \<and> (\<not> (Suc 0 < length args \<and> Suc 0 < length excaps) \<longrightarrow> ?R380 s)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> ?R379 s)
 10. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>asid_tablea y free p. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B384 asid_tablea y free p\<rbrace> if snd p = pageBits then doE y <- ensure_no_children (snd (excaps ! 0));
returnOk (fst p)
odE else throwError (InvalidCapability (Suc 0)) \<lbrace>\<lambda>frame s. True \<and> True \<and> (valid_objs and (\<lambda>a. a \<turnstile> fst (excaps ! Suc 0))) s \<and> ((is_cnode_cap (fst (excaps ! Suc 0)) \<longrightarrow> (\<forall>r\<in>cte_refs (fst (excaps ! Suc 0)) (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cp. is_cnode_cap cp \<longrightarrow> is_cnode_cap cp)) \<and> descendants_of (snd (excaps ! 0)) (cdt s) = {} \<and> cte_wp_at (\<lambda>c. \<exists>idx. c = UntypedCap False frame pageBits idx) (snd (excaps ! 0)) s \<and> asid_table s free = None\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>asid_table y free. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B383 asid_table y free\<rbrace> case fst (excaps ! 0) of UntypedCap True p n f \<Rightarrow> throwError $ InvalidCapability 1 | UntypedCap False p n f \<Rightarrow> returnOk (p, n) | _ \<Rightarrow> throwError $ InvalidCapability 1 \<lbrace>?B384 asid_table y free\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>asid_table y. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B382 asid_table y\<rbrace> liftE (select_ext (\<lambda>_. free_asid_select asid_table) (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1})) \<lbrace>?B383 asid_table y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>asid_table. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B381 asid_table\<rbrace> whenE (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} = {}) (throwError DeleteFirst) \<lbrace>?B382 asid_table\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?Qa380\<rbrace> liftE (gets (arm_asid_table \<circ> arch_state)) \<lbrace>?B381\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; \<not> (Suc 0 < length args \<and> Suc 0 < length excaps)\<rbrakk> \<Longrightarrow> \<lbrace>?R380\<rbrace> throwError TruncatedMessage \<lbrace>valid_arch_inv\<rbrace>, -
 7. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label \<noteq> ArchInvocationLabel ARMASIDControlMakePool\<rbrakk> \<Longrightarrow> \<lbrace>?R379\<rbrace> throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 8. \<And>s. \<lbrakk>arch_cap = ASIDControlCap; (invs and valid_cap (ArchObjectCap ASIDControlCap) and cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)) s\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> (Suc 0 < length args \<and> Suc 0 < length excaps \<longrightarrow> ?Qa380 s) \<and> (\<not> (Suc 0 < length args \<and> Suc 0 < length excaps) \<longrightarrow> ?R380 s)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> ?R379 s)
 9. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 10. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>asid_tablea free p. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B384 asid_tablea () free p\<rbrace> if snd p = pageBits then doE y <- ensure_no_children (snd (excaps ! 0));
returnOk (fst p)
odE else throwError (InvalidCapability (Suc 0)) \<lbrace>\<lambda>frame s. valid_objs s \<and> s \<turnstile> fst (excaps ! Suc 0) \<and> (is_cnode_cap (fst (excaps ! Suc 0)) \<longrightarrow> (\<forall>r\<in>cte_refs (fst (excaps ! Suc 0)) (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> descendants_of (snd (excaps ! 0)) (cdt s) = {} \<and> cte_wp_at (\<lambda>c. \<exists>idx. c = UntypedCap False frame pageBits idx) (snd (excaps ! 0)) s \<and> asid_table s free = None\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>asid_table y free. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B383 asid_table y free\<rbrace> case fst (excaps ! 0) of UntypedCap True p n f \<Rightarrow> throwError $ InvalidCapability 1 | UntypedCap False p n f \<Rightarrow> returnOk (p, n) | _ \<Rightarrow> throwError $ InvalidCapability 1 \<lbrace>?B384 asid_table y free\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>asid_table y. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B382 asid_table y\<rbrace> liftE (select_ext (\<lambda>_. free_asid_select asid_table) (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1})) \<lbrace>?B383 asid_table y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>asid_table. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?B381 asid_table\<rbrace> whenE (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} = {}) (throwError DeleteFirst) \<lbrace>?B382 asid_table\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps\<rbrakk> \<Longrightarrow> \<lbrace>?Qa380\<rbrace> liftE (gets (arm_asid_table \<circ> arch_state)) \<lbrace>?B381\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; \<not> (Suc 0 < length args \<and> Suc 0 < length excaps)\<rbrakk> \<Longrightarrow> \<lbrace>?R380\<rbrace> throwError TruncatedMessage \<lbrace>valid_arch_inv\<rbrace>, -
 7. \<lbrakk>arch_cap = ASIDControlCap; invocation_type label \<noteq> ArchInvocationLabel ARMASIDControlMakePool\<rbrakk> \<Longrightarrow> \<lbrace>?R379\<rbrace> throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 8. \<And>s. \<lbrakk>arch_cap = ASIDControlCap; (invs and valid_cap (ArchObjectCap ASIDControlCap) and cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)) s\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> (Suc 0 < length args \<and> Suc 0 < length excaps \<longrightarrow> ?Qa380 s) \<and> (\<not> (Suc 0 < length args \<and> Suc 0 < length excaps) \<longrightarrow> ?R380 s)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> ?R379 s)
 9. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 10. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
A total of 11 subgoals... proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>arch_cap = ASIDControlCap; invs s \<and> s \<turnstile> ArchObjectCap ASIDControlCap \<and> cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s \<and> (\<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrakk> \<Longrightarrow> invocation_type label = ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> Suc 0 < length args \<and> Suc 0 < length excaps \<longrightarrow> - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> (\<forall>x\<in>- dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1}. \<forall>xa xb. (\<exists>x. fst (excaps ! 0) = UntypedCap xa xb pageBits x) \<longrightarrow> \<not> xa \<longrightarrow> valid_objs s \<and> s \<turnstile> fst (excaps ! Suc 0) \<and> (is_cnode_cap (fst (excaps ! Suc 0)) \<longrightarrow> (\<forall>r\<in>cte_refs (fst (excaps ! Suc 0)) (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> cte_wp_at (\<lambda>c. \<exists>idx. c = UntypedCap False xb pageBits idx) (snd (excaps ! 0)) s \<and> asid_table s x = None)
 2. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s x xa xb xc. \<lbrakk>arch_cap = ASIDControlCap; invs s; s \<turnstile> ArchObjectCap ASIDControlCap; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args; Suc 0 < length excaps; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; x \<le> 2 ^ local.asid_high_bits - 1; asid_table s x = None; fst (excaps ! 0) = UntypedCap False xb pageBits xc; \<not> xa\<rbrakk> \<Longrightarrow> valid_objs s \<and> s \<turnstile> fst (excaps ! Suc 0) \<and> (is_cnode_cap (fst (excaps ! Suc 0)) \<longrightarrow> (\<forall>r\<in>cte_refs (fst (excaps ! Suc 0)) (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> cte_wp_at (\<lambda>c. \<exists>idx. c = UntypedCap False xb pageBits idx) (snd (excaps ! 0)) s
 2. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s x xa xb xc. \<lbrakk>arch_cap = ASIDControlCap; invs s; s \<turnstile> ArchObjectCap ASIDControlCap; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args; Suc 0 < length excaps; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; x \<le> 2 ^ local.asid_high_bits - 1; asid_table s x = None; fst (excaps ! 0) = UntypedCap False xb pageBits xc; \<not> xa\<rbrakk> \<Longrightarrow> s \<turnstile> fst (excaps ! Suc 0) \<and> (is_cnode_cap (fst (excaps ! Suc 0)) \<longrightarrow> (\<forall>r\<in>cte_refs (fst (excaps ! Suc 0)) (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> cte_wp_at (\<lambda>c. \<exists>idx. c = UntypedCap False xb pageBits idx) (snd (excaps ! 0)) s
 2. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s x xa xb xc a list. \<lbrakk>arch_cap = ASIDControlCap; invs s; s \<turnstile> ArchObjectCap ASIDControlCap; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args; Suc 0 < length excaps; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; x \<le> 2 ^ local.asid_high_bits - 1; asid_table s x = None; fst (excaps ! 0) = UntypedCap False xb pageBits xc; \<not> xa; excaps = a # list\<rbrakk> \<Longrightarrow> s \<turnstile> fst (excaps ! Suc 0) \<and> (is_cnode_cap (fst (excaps ! Suc 0)) \<longrightarrow> (\<forall>r\<in>cte_refs (fst (excaps ! Suc 0)) (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> cte_wp_at (\<lambda>c. \<exists>idx. c = UntypedCap False xb pageBits idx) (snd (excaps ! 0)) s
 2. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s x xa xb xc a list aa lista. \<lbrakk>arch_cap = ASIDControlCap; invs s; s \<turnstile> ArchObjectCap ASIDControlCap; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args; Suc 0 < length excaps; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; x \<le> 2 ^ local.asid_high_bits - 1; asid_table s x = None; fst (excaps ! 0) = UntypedCap False xb pageBits xc; \<not> xa; excaps = a # list; list = aa # lista\<rbrakk> \<Longrightarrow> s \<turnstile> fst (excaps ! Suc 0) \<and> (is_cnode_cap (fst (excaps ! Suc 0)) \<longrightarrow> (\<forall>r\<in>cte_refs (fst (excaps ! Suc 0)) (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> cte_wp_at (\<lambda>c. \<exists>idx. c = UntypedCap False xb pageBits idx) (snd (excaps ! 0)) s
 2. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s x xa xb xc aa b ab ac ba lista. \<lbrakk>arch_cap = ASIDControlCap; invs s; s \<turnstile> ArchObjectCap ASIDControlCap; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; x \<le> 2 ^ local.asid_high_bits - 1; asid_table s x = None; \<not> xa; excaps = (UntypedCap False xb pageBits xc, aa, b) # (ab, ac, ba) # lista; cte_wp_at ((=) (UntypedCap False xb pageBits xc)) (aa, b) s; cte_wp_at ((=) ab) (ac, ba) s; \<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> s \<turnstile> ab \<and> (is_cnode_cap ab \<longrightarrow> (\<forall>r\<in>cte_refs ab (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> cte_wp_at (\<lambda>c. \<exists>idx. c = UntypedCap False xb pageBits idx) (aa, b) s
 2. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>s x xa xb xc aa b ab ac ba lista. \<lbrakk>arch_cap = ASIDControlCap; invs s; s \<turnstile> ArchObjectCap ASIDControlCap; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; x \<le> 2 ^ local.asid_high_bits - 1; asid_table s x = None; \<not> xa; excaps = (UntypedCap False xb pageBits xc, aa, b) # (ab, ac, ba) # lista; cte_wp_at ((=) (UntypedCap False xb pageBits xc)) (aa, b) s; cte_wp_at ((=) ab) (ac, ba) s; \<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> s \<turnstile> ab
 2. \<And>s x xa xb xc aa b ab ac ba lista. \<lbrakk>arch_cap = ASIDControlCap; invs s; s \<turnstile> ArchObjectCap ASIDControlCap; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; x \<le> 2 ^ local.asid_high_bits - 1; asid_table s x = None; \<not> xa; excaps = (UntypedCap False xb pageBits xc, aa, b) # (ab, ac, ba) # lista; cte_wp_at ((=) (UntypedCap False xb pageBits xc)) (aa, b) s; cte_wp_at ((=) ab) (ac, ba) s; \<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> (is_cnode_cap ab \<longrightarrow> (\<forall>r\<in>cte_refs ab (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> cte_wp_at (\<lambda>c. \<exists>idx. c = UntypedCap False xb pageBits idx) (aa, b) s
 3. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>s x xa xb xc aa b ab ac ba lista. \<lbrakk>arch_cap = ASIDControlCap; invs s; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; x \<le> 2 ^ local.asid_high_bits - 1; asid_table s x = None; \<not> xa; excaps = (UntypedCap False xb pageBits xc, aa, b) # (ab, ac, ba) # lista; \<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s; s \<turnstile> UntypedCap False xb pageBits xc; s \<turnstile> ArchObjectCap ASIDControlCap; s \<turnstile> ab\<rbrakk> \<Longrightarrow> s \<turnstile> ab
 2. \<And>s x xa xb xc aa b ab ac ba lista. \<lbrakk>arch_cap = ASIDControlCap; invs s; s \<turnstile> ArchObjectCap ASIDControlCap; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; x \<le> 2 ^ local.asid_high_bits - 1; asid_table s x = None; \<not> xa; excaps = (UntypedCap False xb pageBits xc, aa, b) # (ab, ac, ba) # lista; cte_wp_at ((=) (UntypedCap False xb pageBits xc)) (aa, b) s; cte_wp_at ((=) ab) (ac, ba) s; \<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> (is_cnode_cap ab \<longrightarrow> (\<forall>r\<in>cte_refs ab (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> cte_wp_at (\<lambda>c. \<exists>idx. c = UntypedCap False xb pageBits idx) (aa, b) s
 3. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s x xa xb xc aa b ab ac ba lista. \<lbrakk>arch_cap = ASIDControlCap; invs s; s \<turnstile> ArchObjectCap ASIDControlCap; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; x \<le> 2 ^ local.asid_high_bits - 1; asid_table s x = None; \<not> xa; excaps = (UntypedCap False xb pageBits xc, aa, b) # (ab, ac, ba) # lista; cte_wp_at ((=) (UntypedCap False xb pageBits xc)) (aa, b) s; cte_wp_at ((=) ab) (ac, ba) s; \<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> (is_cnode_cap ab \<longrightarrow> (\<forall>r\<in>cte_refs ab (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> cte_wp_at (\<lambda>c. \<exists>idx. c = UntypedCap False xb pageBits idx) (aa, b) s
 2. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>s x xa xb xc aa b ab ac ba lista. \<lbrakk>arch_cap = ASIDControlCap; invs s; s \<turnstile> ArchObjectCap ASIDControlCap; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; x \<le> 2 ^ local.asid_high_bits - 1; asid_table s x = None; \<not> xa; excaps = (UntypedCap False xb pageBits xc, aa, b) # (ab, ac, ba) # lista; cte_wp_at ((=) (UntypedCap False xb pageBits xc)) (aa, b) s; cte_wp_at ((=) ab) (ac, ba) s; \<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> is_cnode_cap ab \<longrightarrow> (\<forall>r\<in>cte_refs ab (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)
 2. \<And>s x xa xb xc aa b ab ac ba lista. \<lbrakk>arch_cap = ASIDControlCap; invs s; s \<turnstile> ArchObjectCap ASIDControlCap; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; x \<le> 2 ^ local.asid_high_bits - 1; asid_table s x = None; \<not> xa; excaps = (UntypedCap False xb pageBits xc, aa, b) # (ab, ac, ba) # lista; cte_wp_at ((=) (UntypedCap False xb pageBits xc)) (aa, b) s; cte_wp_at ((=) ab) (ac, ba) s; \<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. \<exists>idx. c = UntypedCap False xb pageBits idx) (aa, b) s
 3. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>s x xa xb xc aa b ab ac ba lista a bb. \<lbrakk>arch_cap = ASIDControlCap; invs s; s \<turnstile> ArchObjectCap ASIDControlCap; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; x \<le> 2 ^ local.asid_high_bits - 1; asid_table s x = None; \<not> xa; excaps = (UntypedCap False xb pageBits xc, aa, b) # (ab, ac, ba) # lista; cte_wp_at ((=) (UntypedCap False xb pageBits xc)) (aa, b) s; cte_wp_at ((=) ab) (ac, ba) s; \<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s; is_cnode_cap ab; (a, bb) \<in> cte_refs ab (interrupt_irq_node s)\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to is_cnode_cap (a, bb) s
 2. \<And>s x xa xb xc aa b ab ac ba lista. \<lbrakk>arch_cap = ASIDControlCap; invs s; s \<turnstile> ArchObjectCap ASIDControlCap; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; x \<le> 2 ^ local.asid_high_bits - 1; asid_table s x = None; \<not> xa; excaps = (UntypedCap False xb pageBits xc, aa, b) # (ab, ac, ba) # lista; cte_wp_at ((=) (UntypedCap False xb pageBits xc)) (aa, b) s; cte_wp_at ((=) ab) (ac, ba) s; \<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. \<exists>idx. c = UntypedCap False xb pageBits idx) (aa, b) s
 3. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>s x xa xb xc aa b ab ac ba lista a bb. \<lbrakk>arch_cap = ASIDControlCap; invs s; s \<turnstile> ArchObjectCap ASIDControlCap; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; x \<le> 2 ^ local.asid_high_bits - 1; asid_table s x = None; \<not> xa; excaps = (UntypedCap False xb pageBits xc, aa, b) # (ab, ac, ba) # lista; cte_wp_at ((=) (UntypedCap False xb pageBits xc)) (aa, b) s; cte_wp_at ((=) ab) (ac, ba) s; \<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s; is_cnode_cap ab; (a, bb) \<in> cte_refs ab (interrupt_irq_node s)\<rbrakk> \<Longrightarrow> \<exists>aa b. cte_wp_at (\<lambda>c. is_cnode_cap c \<and> (a, bb) \<in> cte_refs c (interrupt_irq_node s)) (aa, b) s
 2. \<And>s x xa xb xc aa b ab ac ba lista. \<lbrakk>arch_cap = ASIDControlCap; invs s; s \<turnstile> ArchObjectCap ASIDControlCap; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; x \<le> 2 ^ local.asid_high_bits - 1; asid_table s x = None; \<not> xa; excaps = (UntypedCap False xb pageBits xc, aa, b) # (ab, ac, ba) # lista; cte_wp_at ((=) (UntypedCap False xb pageBits xc)) (aa, b) s; cte_wp_at ((=) ab) (ac, ba) s; \<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. \<exists>idx. c = UntypedCap False xb pageBits idx) (aa, b) s
 3. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>s x xa xb xc aa b ab ac ba lista a bb. \<lbrakk>arch_cap = ASIDControlCap; invs s; s \<turnstile> ArchObjectCap ASIDControlCap; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; x \<le> 2 ^ local.asid_high_bits - 1; asid_table s x = None; \<not> xa; excaps = (UntypedCap False xb pageBits xc, aa, b) # (ab, ac, ba) # lista; cte_wp_at ((=) (UntypedCap False xb pageBits xc)) (aa, b) s; cte_wp_at ((=) ab) (ac, ba) s; \<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s; is_cnode_cap ab; (a, bb) \<in> cte_refs ab (interrupt_irq_node s)\<rbrakk> \<Longrightarrow> \<exists>b. cte_wp_at (\<lambda>c. is_cnode_cap c \<and> (a, bb) \<in> cte_refs c (interrupt_irq_node s)) (ac, b) s
 2. \<And>s x xa xb xc aa b ab ac ba lista. \<lbrakk>arch_cap = ASIDControlCap; invs s; s \<turnstile> ArchObjectCap ASIDControlCap; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; x \<le> 2 ^ local.asid_high_bits - 1; asid_table s x = None; \<not> xa; excaps = (UntypedCap False xb pageBits xc, aa, b) # (ab, ac, ba) # lista; cte_wp_at ((=) (UntypedCap False xb pageBits xc)) (aa, b) s; cte_wp_at ((=) ab) (ac, ba) s; \<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. \<exists>idx. c = UntypedCap False xb pageBits idx) (aa, b) s
 3. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>s x xa xb xc aa b ab ac ba lista a bb. \<lbrakk>arch_cap = ASIDControlCap; invs s; s \<turnstile> ArchObjectCap ASIDControlCap; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; x \<le> 2 ^ local.asid_high_bits - 1; asid_table s x = None; \<not> xa; excaps = (UntypedCap False xb pageBits xc, aa, b) # (ab, ac, ba) # lista; cte_wp_at ((=) (UntypedCap False xb pageBits xc)) (aa, b) s; cte_wp_at ((=) ab) (ac, ba) s; \<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s; is_cnode_cap ab; (a, bb) \<in> cte_refs ab (interrupt_irq_node s)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. is_cnode_cap c \<and> (a, bb) \<in> cte_refs c (interrupt_irq_node s)) (ac, ba) s
 2. \<And>s x xa xb xc aa b ab ac ba lista. \<lbrakk>arch_cap = ASIDControlCap; invs s; s \<turnstile> ArchObjectCap ASIDControlCap; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; x \<le> 2 ^ local.asid_high_bits - 1; asid_table s x = None; \<not> xa; excaps = (UntypedCap False xb pageBits xc, aa, b) # (ab, ac, ba) # lista; cte_wp_at ((=) (UntypedCap False xb pageBits xc)) (aa, b) s; cte_wp_at ((=) ab) (ac, ba) s; \<forall>x\<in>set lista. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. \<exists>idx. c = UntypedCap False xb pageBits idx) (aa, b) s
 3. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> arch_decode_invocation label args cap_index slot (PageCap x31 x32 x33 x34 x35) excaps \<lbrace>valid_arch_inv\<rbrace>, -
 2. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 2. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>x31 x32 x33 x34 x35. arch_cap = PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 2. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label = ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>dev word rights vmpage_size option. \<lbrakk>arch_cap = PageCap dev word rights vmpage_size option; invocation_type label = ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap dev word rights vmpage_size option)) and cte_wp_at ((=) (ArchObjectCap (PageCap dev word rights vmpage_size option))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case option of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize vmpage_size) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment vmpage_size (args ! 0);
entries <- create_mapping_entries (addrFromPPtr word) (args ! 0) vmpage_size (mask_vm_rights rights (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap dev word rights vmpage_size (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap dev word rights vmpage_size option) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case option of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize vmpage_size \<le> args ! 0 \<or> 2 ^ pageBitsForSize vmpage_size < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr word + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr word)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>dev word rights vmpage_size option. \<lbrakk>arch_cap = PageCap dev word rights vmpage_size option; invocation_type label = ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>?P'739 dev word rights vmpage_size option\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case option of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize vmpage_size) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment vmpage_size (args ! 0);
entries <- create_mapping_entries (addrFromPPtr word) (args ! 0) vmpage_size (mask_vm_rights rights (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap dev word rights vmpage_size (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap dev word rights vmpage_size option) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case option of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize vmpage_size \<le> args ! 0 \<or> 2 ^ pageBitsForSize vmpage_size < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr word + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr word)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 2. \<And>dev word rights vmpage_size option s. \<lbrakk>arch_cap = PageCap dev word rights vmpage_size option; invocation_type label = ArchInvocationLabel ARMPageMap; (invs and valid_cap (ArchObjectCap (PageCap dev word rights vmpage_size option)) and cte_wp_at ((=) (ArchObjectCap (PageCap dev word rights vmpage_size option))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))) s\<rbrakk> \<Longrightarrow> ?P'739 dev word rights vmpage_size option s
 3. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>dev word rights vmpage_size option s. \<lbrakk>arch_cap = PageCap dev word rights vmpage_size option; invocation_type label = ArchInvocationLabel ARMPageMap; invs s \<and> s \<turnstile> ArchObjectCap (PageCap dev word rights vmpage_size option) \<and> cte_wp_at ((=) (ArchObjectCap (PageCap dev word rights vmpage_size option))) slot s \<and> (\<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrakk> \<Longrightarrow> 2 < length args \<and> excaps \<noteq> [] \<longrightarrow> (option = None \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> (if kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize vmpage_size - 1 then \<lambda>s. True \<and> True else (\<lambda>s. valid_vspace_objs s \<and> (\<forall>pd. vspace_at_asid (snd (xa, x)) pd s \<and> typ_at (AArch APageDirectory) pd s \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> pd \<noteq> fst (xa, x) \<longrightarrow> True \<and> (vmsz_aligned (args ! 0) vmpage_size \<longrightarrow> True \<and> True \<and> cte_wp_at (is_arch_update (ArchObjectCap (PageCap dev word rights vmpage_size (Some (snd (xa, x), args ! 0))))) slot s \<and> (cte_wp_at (\<lambda>c. vs_cap_ref c = None) slot s \<or> (\<exists>v. caps_of_state s slot = Some v \<and> (valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and (\<lambda>s. \<exists>dev pd_cap pd_cptr asid rights'. cte_wp_at ((=) pd_cap) pd_cptr s \<and> pd_cap = ArchObjectCap (PageDirectoryCap (fst (xa, x)) (Some asid)) \<and> typ_at (AArch APageDirectory) (fst (xa, x)) s \<and> args ! 0 < kernel_base \<and> v = ArchObjectCap (PageCap dev word rights' vmpage_size (Some (asid, args ! 0))))) s)) \<and> cte_wp_at is_pg_cap slot s \<and> (valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and (\<lambda>s. \<exists>deva pd_cap pd_cptr asid rights'. cte_wp_at ((=) pd_cap) pd_cptr s \<and> pd_cap = ArchObjectCap (PageDirectoryCap (fst (xa, x)) (Some asid)) \<and> typ_at (AArch APageDirectory) (fst (xa, x)) s \<and> args ! 0 < kernel_base \<and> ArchObjectCap (PageCap dev word rights vmpage_size (Some (snd (xa, x), args ! 0))) = ArchObjectCap (PageCap deva word rights' vmpage_size (Some (asid, args ! 0))))) s \<and> (valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and typ_at (AArch APageDirectory) (fst (xa, x)) and data_at vmpage_size (ptrFromPAddr (addrFromPPtr word)) and K (vmsz_aligned (addrFromPPtr word) vmpage_size \<and> vmsz_aligned (args ! 0) vmpage_size \<and> args ! 0 < kernel_base \<and> mask_vm_rights rights (data_to_rights (args ! Suc 0)) \<in> valid_vm_rights)) s \<and> s \<turnstile> ArchObjectCap (PageCap dev word rights vmpage_size (Some (snd (xa, x), args ! 0))) \<and> True \<and> snd (xa, x) \<le> mask local.asid_bits \<and> snd (xa, x) \<noteq> 0 \<and> (invs and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and typ_at (AArch APageDirectory) (fst (xa, x)) and K (is_aligned (fst (xa, x)) pd_bits) and K (vmsz_aligned (args ! 0) vmpage_size) and K (args ! 0 < kernel_base)) s \<and> (\<exists>v. vspace_at_asid (snd (xa, x)) v s))))) s)))) \<and> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>a. option = Some (a, args ! 0) \<longrightarrow> (if a \<noteq> x then \<lambda>s. True \<and> True else (\<lambda>s. valid_vspace_objs s \<and> (vspace_at_asid (snd (xa, x)) (fst (xa, x)) s \<and> typ_at (AArch APageDirectory) (fst (xa, x)) s \<and> (\<exists>ref. (ref \<rhd> fst (xa, x)) s) \<longrightarrow> vmsz_aligned (args ! 0) vmpage_size \<longrightarrow> cte_wp_at (is_arch_update (ArchObjectCap (PageCap dev word rights vmpage_size (Some (snd (xa, x), args ! 0))))) slot s \<and> (cte_wp_at (\<lambda>c. vs_cap_ref c = None) slot s \<or> (\<exists>v. caps_of_state s slot = Some v \<and> valid_arch_state s \<and> valid_vspace_objs s \<and> valid_vs_lookup s \<and> unique_table_refs (caps_of_state s) \<and> pspace_aligned s \<and> valid_objs s \<and> valid_kernel_mappings s \<and> (\<exists>dev pd_cap. (\<exists>a b. cte_wp_at ((=) pd_cap) (a, b) s) \<and> (\<exists>asid. pd_cap = ArchObjectCap (PageDirectoryCap (fst (xa, x)) (Some asid)) \<and> args ! 0 < kernel_base \<and> (\<exists>rights'. v = ArchObjectCap (PageCap dev word rights' vmpage_size (Some (asid, args ! 0)))))))) \<and> cte_wp_at (\<lambda>a. \<exists>dev p R sz m. a = ArchObjectCap (PageCap dev p R sz m)) slot s \<and> valid_arch_state s \<and> valid_vspace_objs s \<and> valid_vs_lookup s \<and> unique_table_refs (caps_of_state s) \<and> pspace_aligned s \<and> valid_objs s \<and> valid_kernel_mappings s \<and> (\<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap (fst (xa, x)) (Some (snd (xa, x)))))) (a, b) s) \<and> args ! 0 < kernel_base \<and> valid_arch_state s \<and> valid_vspace_objs s \<and> equal_kernel_mappings s \<and> pspace_aligned s \<and> valid_global_objs s \<and> data_at vmpage_size word s \<and> vmsz_aligned (addrFromPPtr word) vmpage_size \<and> args ! 0 < kernel_base \<and> s \<turnstile> ArchObjectCap (PageCap dev word rights vmpage_size (Some (snd (xa, x), args ! 0))) \<and> snd (xa, x) \<le> mask local.asid_bits \<and> snd (xa, x) \<noteq> 0 \<and> invs s \<and> is_aligned (fst (xa, x)) pd_bits \<and> args ! 0 < kernel_base \<and> (\<exists>v. vspace_at_asid (snd (xa, x)) v s)))) s))))
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>dev word rights vmpage_size option s a aa b ys. \<lbrakk>arch_cap = PageCap dev word rights vmpage_size option; invocation_type label = ArchInvocationLabel ARMPageMap; invs s; s \<turnstile> ArchObjectCap (PageCap dev word rights vmpage_size option); cte_wp_at ((=) (ArchObjectCap (PageCap dev word rights vmpage_size option))) slot s; 2 < length args; excaps = (a, aa, b) # ys; caps_of_state s (aa, b) = Some a; \<forall>x\<in>set ys. caps_of_state s (snd x) = Some (fst x)\<rbrakk> \<Longrightarrow> (option = None \<longrightarrow> (\<forall>x. a = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> (if kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize vmpage_size - 1 then \<lambda>s. True \<and> True else (\<lambda>s. valid_vspace_objs s \<and> (\<forall>pd. vspace_at_asid (snd (xa, x)) pd s \<and> typ_at (AArch APageDirectory) pd s \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> pd \<noteq> fst (xa, x) \<longrightarrow> True \<and> (vmsz_aligned (args ! 0) vmpage_size \<longrightarrow> True \<and> True \<and> cte_wp_at (is_arch_update (ArchObjectCap (PageCap dev word rights vmpage_size (Some (snd (xa, x), args ! 0))))) slot s \<and> (cte_wp_at (\<lambda>c. vs_cap_ref c = None) slot s \<or> (\<exists>v. caps_of_state s slot = Some v \<and> (valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and (\<lambda>s. \<exists>dev pd_cap pd_cptr asid rights'. cte_wp_at ((=) pd_cap) pd_cptr s \<and> pd_cap = ArchObjectCap (PageDirectoryCap (fst (xa, x)) (Some asid)) \<and> typ_at (AArch APageDirectory) (fst (xa, x)) s \<and> args ! 0 < kernel_base \<and> v = ArchObjectCap (PageCap dev word rights' vmpage_size (Some (asid, args ! 0))))) s)) \<and> cte_wp_at is_pg_cap slot s \<and> (valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and (\<lambda>s. \<exists>deva pd_cap pd_cptr asid rights'. cte_wp_at ((=) pd_cap) pd_cptr s \<and> pd_cap = ArchObjectCap (PageDirectoryCap (fst (xa, x)) (Some asid)) \<and> typ_at (AArch APageDirectory) (fst (xa, x)) s \<and> args ! 0 < kernel_base \<and> ArchObjectCap (PageCap dev word rights vmpage_size (Some (snd (xa, x), args ! 0))) = ArchObjectCap (PageCap deva word rights' vmpage_size (Some (asid, args ! 0))))) s \<and> (valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and typ_at (AArch APageDirectory) (fst (xa, x)) and data_at vmpage_size (ptrFromPAddr (addrFromPPtr word)) and K (vmsz_aligned (addrFromPPtr word) vmpage_size \<and> vmsz_aligned (args ! 0) vmpage_size \<and> args ! 0 < kernel_base \<and> mask_vm_rights rights (data_to_rights (args ! Suc 0)) \<in> valid_vm_rights)) s \<and> s \<turnstile> ArchObjectCap (PageCap dev word rights vmpage_size (Some (snd (xa, x), args ! 0))) \<and> True \<and> snd (xa, x) \<le> mask local.asid_bits \<and> snd (xa, x) \<noteq> 0 \<and> (invs and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and typ_at (AArch APageDirectory) (fst (xa, x)) and K (is_aligned (fst (xa, x)) pd_bits) and K (vmsz_aligned (args ! 0) vmpage_size) and K (args ! 0 < kernel_base)) s \<and> (\<exists>v. vspace_at_asid (snd (xa, x)) v s))))) s)))) \<and> (\<forall>x. a = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>a. option = Some (a, args ! 0) \<longrightarrow> (if a \<noteq> x then \<lambda>s. True \<and> True else (\<lambda>s. valid_vspace_objs s \<and> (vspace_at_asid (snd (xa, x)) (fst (xa, x)) s \<and> typ_at (AArch APageDirectory) (fst (xa, x)) s \<and> (\<exists>ref. (ref \<rhd> fst (xa, x)) s) \<longrightarrow> vmsz_aligned (args ! 0) vmpage_size \<longrightarrow> cte_wp_at (is_arch_update (ArchObjectCap (PageCap dev word rights vmpage_size (Some (snd (xa, x), args ! 0))))) slot s \<and> (cte_wp_at (\<lambda>c. vs_cap_ref c = None) slot s \<or> (\<exists>v. caps_of_state s slot = Some v \<and> valid_arch_state s \<and> valid_vspace_objs s \<and> valid_vs_lookup s \<and> unique_table_refs (caps_of_state s) \<and> pspace_aligned s \<and> valid_objs s \<and> valid_kernel_mappings s \<and> (\<exists>dev pd_cap. (\<exists>a b. cte_wp_at ((=) pd_cap) (a, b) s) \<and> (\<exists>asid. pd_cap = ArchObjectCap (PageDirectoryCap (fst (xa, x)) (Some asid)) \<and> args ! 0 < kernel_base \<and> (\<exists>rights'. v = ArchObjectCap (PageCap dev word rights' vmpage_size (Some (asid, args ! 0)))))))) \<and> cte_wp_at (\<lambda>a. \<exists>dev p R sz m. a = ArchObjectCap (PageCap dev p R sz m)) slot s \<and> valid_arch_state s \<and> valid_vspace_objs s \<and> valid_vs_lookup s \<and> unique_table_refs (caps_of_state s) \<and> pspace_aligned s \<and> valid_objs s \<and> valid_kernel_mappings s \<and> (\<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap (fst (xa, x)) (Some (snd (xa, x)))))) (a, b) s) \<and> args ! 0 < kernel_base \<and> valid_arch_state s \<and> valid_vspace_objs s \<and> equal_kernel_mappings s \<and> pspace_aligned s \<and> valid_global_objs s \<and> data_at vmpage_size word s \<and> vmsz_aligned (addrFromPPtr word) vmpage_size \<and> args ! 0 < kernel_base \<and> s \<turnstile> ArchObjectCap (PageCap dev word rights vmpage_size (Some (snd (xa, x), args ! 0))) \<and> snd (xa, x) \<le> mask local.asid_bits \<and> snd (xa, x) \<noteq> 0 \<and> invs s \<and> is_aligned (fst (xa, x)) pd_bits \<and> args ! 0 < kernel_base \<and> (\<exists>v. vspace_at_asid (snd (xa, x)) v s)))) s))))
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>dev word rights vmpage_size option s a aa b ys. \<lbrakk>arch_cap = PageCap dev word rights vmpage_size option; invocation_type label = ArchInvocationLabel ARMPageMap; invs s; s \<turnstile> ArchObjectCap (PageCap dev word rights vmpage_size option); cte_wp_at ((=) (ArchObjectCap (PageCap dev word rights vmpage_size option))) slot s; 2 < length args; excaps = (a, aa, b) # ys; caps_of_state s (aa, b) = Some a; \<forall>x\<in>set ys. caps_of_state s (snd x) = Some (fst x); s \<turnstile> a\<rbrakk> \<Longrightarrow> (option = None \<longrightarrow> (\<forall>x. a = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> (if kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize vmpage_size - 1 then \<lambda>s. True \<and> True else (\<lambda>s. valid_vspace_objs s \<and> (\<forall>pd. vspace_at_asid (snd (xa, x)) pd s \<and> typ_at (AArch APageDirectory) pd s \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> pd \<noteq> fst (xa, x) \<longrightarrow> True \<and> (vmsz_aligned (args ! 0) vmpage_size \<longrightarrow> True \<and> True \<and> cte_wp_at (is_arch_update (ArchObjectCap (PageCap dev word rights vmpage_size (Some (snd (xa, x), args ! 0))))) slot s \<and> (cte_wp_at (\<lambda>c. vs_cap_ref c = None) slot s \<or> (\<exists>v. caps_of_state s slot = Some v \<and> (valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and (\<lambda>s. \<exists>dev pd_cap pd_cptr asid rights'. cte_wp_at ((=) pd_cap) pd_cptr s \<and> pd_cap = ArchObjectCap (PageDirectoryCap (fst (xa, x)) (Some asid)) \<and> typ_at (AArch APageDirectory) (fst (xa, x)) s \<and> args ! 0 < kernel_base \<and> v = ArchObjectCap (PageCap dev word rights' vmpage_size (Some (asid, args ! 0))))) s)) \<and> cte_wp_at is_pg_cap slot s \<and> (valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and (\<lambda>s. \<exists>deva pd_cap pd_cptr asid rights'. cte_wp_at ((=) pd_cap) pd_cptr s \<and> pd_cap = ArchObjectCap (PageDirectoryCap (fst (xa, x)) (Some asid)) \<and> typ_at (AArch APageDirectory) (fst (xa, x)) s \<and> args ! 0 < kernel_base \<and> ArchObjectCap (PageCap dev word rights vmpage_size (Some (snd (xa, x), args ! 0))) = ArchObjectCap (PageCap deva word rights' vmpage_size (Some (asid, args ! 0))))) s \<and> (valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and typ_at (AArch APageDirectory) (fst (xa, x)) and data_at vmpage_size (ptrFromPAddr (addrFromPPtr word)) and K (vmsz_aligned (addrFromPPtr word) vmpage_size \<and> vmsz_aligned (args ! 0) vmpage_size \<and> args ! 0 < kernel_base \<and> mask_vm_rights rights (data_to_rights (args ! Suc 0)) \<in> valid_vm_rights)) s \<and> s \<turnstile> ArchObjectCap (PageCap dev word rights vmpage_size (Some (snd (xa, x), args ! 0))) \<and> True \<and> snd (xa, x) \<le> mask local.asid_bits \<and> snd (xa, x) \<noteq> 0 \<and> (invs and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and typ_at (AArch APageDirectory) (fst (xa, x)) and K (is_aligned (fst (xa, x)) pd_bits) and K (vmsz_aligned (args ! 0) vmpage_size) and K (args ! 0 < kernel_base)) s \<and> (\<exists>v. vspace_at_asid (snd (xa, x)) v s))))) s)))) \<and> (\<forall>x. a = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>a. option = Some (a, args ! 0) \<longrightarrow> (if a \<noteq> x then \<lambda>s. True \<and> True else (\<lambda>s. valid_vspace_objs s \<and> (vspace_at_asid (snd (xa, x)) (fst (xa, x)) s \<and> typ_at (AArch APageDirectory) (fst (xa, x)) s \<and> (\<exists>ref. (ref \<rhd> fst (xa, x)) s) \<longrightarrow> vmsz_aligned (args ! 0) vmpage_size \<longrightarrow> cte_wp_at (is_arch_update (ArchObjectCap (PageCap dev word rights vmpage_size (Some (snd (xa, x), args ! 0))))) slot s \<and> (cte_wp_at (\<lambda>c. vs_cap_ref c = None) slot s \<or> (\<exists>v. caps_of_state s slot = Some v \<and> valid_arch_state s \<and> valid_vspace_objs s \<and> valid_vs_lookup s \<and> unique_table_refs (caps_of_state s) \<and> pspace_aligned s \<and> valid_objs s \<and> valid_kernel_mappings s \<and> (\<exists>dev pd_cap. (\<exists>a b. cte_wp_at ((=) pd_cap) (a, b) s) \<and> (\<exists>asid. pd_cap = ArchObjectCap (PageDirectoryCap (fst (xa, x)) (Some asid)) \<and> args ! 0 < kernel_base \<and> (\<exists>rights'. v = ArchObjectCap (PageCap dev word rights' vmpage_size (Some (asid, args ! 0)))))))) \<and> cte_wp_at (\<lambda>a. \<exists>dev p R sz m. a = ArchObjectCap (PageCap dev p R sz m)) slot s \<and> valid_arch_state s \<and> valid_vspace_objs s \<and> valid_vs_lookup s \<and> unique_table_refs (caps_of_state s) \<and> pspace_aligned s \<and> valid_objs s \<and> valid_kernel_mappings s \<and> (\<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap (fst (xa, x)) (Some (snd (xa, x)))))) (a, b) s) \<and> args ! 0 < kernel_base \<and> valid_arch_state s \<and> valid_vspace_objs s \<and> equal_kernel_mappings s \<and> pspace_aligned s \<and> valid_global_objs s \<and> data_at vmpage_size word s \<and> vmsz_aligned (addrFromPPtr word) vmpage_size \<and> args ! 0 < kernel_base \<and> s \<turnstile> ArchObjectCap (PageCap dev word rights vmpage_size (Some (snd (xa, x), args ! 0))) \<and> snd (xa, x) \<le> mask local.asid_bits \<and> snd (xa, x) \<noteq> 0 \<and> invs s \<and> is_aligned (fst (xa, x)) pd_bits \<and> args ! 0 < kernel_base \<and> (\<exists>v. vspace_at_asid (snd (xa, x)) v s)))) s))))
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>dev word rights vmpage_size option s a aa b ys. \<lbrakk>arch_cap = PageCap dev word rights vmpage_size option; invocation_type label = ArchInvocationLabel ARMPageMap; invs s; s \<turnstile> ArchObjectCap (PageCap dev word rights vmpage_size option); caps_of_state s slot = Some (ArchObjectCap (PageCap dev word rights vmpage_size option)); 2 < length args; excaps = (a, aa, b) # ys; caps_of_state s (aa, b) = Some a; \<forall>x\<in>set ys. caps_of_state s (snd x) = Some (fst x); s \<turnstile> a\<rbrakk> \<Longrightarrow> (option = None \<longrightarrow> (\<forall>x. a = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> (if kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize vmpage_size - 1 then \<lambda>s. True \<and> True else (\<lambda>s. valid_vspace_objs s \<and> (\<forall>pd. vspace_at_asid (snd (xa, x)) pd s \<and> typ_at (AArch APageDirectory) pd s \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> pd \<noteq> fst (xa, x) \<longrightarrow> True \<and> (vmsz_aligned (args ! 0) vmpage_size \<longrightarrow> True \<and> True \<and> cte_wp_at (is_arch_update (ArchObjectCap (PageCap dev word rights vmpage_size (Some (snd (xa, x), args ! 0))))) slot s \<and> (cte_wp_at (\<lambda>c. vs_cap_ref c = None) slot s \<or> (\<exists>v. caps_of_state s slot = Some v \<and> (valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and (\<lambda>s. \<exists>dev pd_cap pd_cptr asid rights'. cte_wp_at ((=) pd_cap) pd_cptr s \<and> pd_cap = ArchObjectCap (PageDirectoryCap (fst (xa, x)) (Some asid)) \<and> typ_at (AArch APageDirectory) (fst (xa, x)) s \<and> args ! 0 < kernel_base \<and> v = ArchObjectCap (PageCap dev word rights' vmpage_size (Some (asid, args ! 0))))) s)) \<and> cte_wp_at is_pg_cap slot s \<and> (valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and (\<lambda>s. \<exists>deva pd_cap pd_cptr asid rights'. cte_wp_at ((=) pd_cap) pd_cptr s \<and> pd_cap = ArchObjectCap (PageDirectoryCap (fst (xa, x)) (Some asid)) \<and> typ_at (AArch APageDirectory) (fst (xa, x)) s \<and> args ! 0 < kernel_base \<and> ArchObjectCap (PageCap dev word rights vmpage_size (Some (snd (xa, x), args ! 0))) = ArchObjectCap (PageCap deva word rights' vmpage_size (Some (asid, args ! 0))))) s \<and> (valid_arch_state and valid_vspace_objs and equal_kernel_mappings and pspace_aligned and valid_global_objs and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and typ_at (AArch APageDirectory) (fst (xa, x)) and data_at vmpage_size (ptrFromPAddr (addrFromPPtr word)) and K (vmsz_aligned (addrFromPPtr word) vmpage_size \<and> vmsz_aligned (args ! 0) vmpage_size \<and> args ! 0 < kernel_base \<and> mask_vm_rights rights (data_to_rights (args ! Suc 0)) \<in> valid_vm_rights)) s \<and> s \<turnstile> ArchObjectCap (PageCap dev word rights vmpage_size (Some (snd (xa, x), args ! 0))) \<and> True \<and> snd (xa, x) \<le> mask local.asid_bits \<and> snd (xa, x) \<noteq> 0 \<and> (invs and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and typ_at (AArch APageDirectory) (fst (xa, x)) and K (is_aligned (fst (xa, x)) pd_bits) and K (vmsz_aligned (args ! 0) vmpage_size) and K (args ! 0 < kernel_base)) s \<and> (\<exists>v. vspace_at_asid (snd (xa, x)) v s))))) s)))) \<and> (\<forall>x. a = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> (\<forall>a. option = Some (a, args ! 0) \<longrightarrow> (if a \<noteq> x then \<lambda>s. True \<and> True else (\<lambda>s. valid_vspace_objs s \<and> (vspace_at_asid (snd (xa, x)) (fst (xa, x)) s \<and> typ_at (AArch APageDirectory) (fst (xa, x)) s \<and> (\<exists>ref. (ref \<rhd> fst (xa, x)) s) \<longrightarrow> vmsz_aligned (args ! 0) vmpage_size \<longrightarrow> cte_wp_at (is_arch_update (ArchObjectCap (PageCap dev word rights vmpage_size (Some (snd (xa, x), args ! 0))))) slot s \<and> (cte_wp_at (\<lambda>c. vs_cap_ref c = None) slot s \<or> (\<exists>v. caps_of_state s slot = Some v \<and> valid_arch_state s \<and> valid_vspace_objs s \<and> valid_vs_lookup s \<and> unique_table_refs (caps_of_state s) \<and> pspace_aligned s \<and> valid_objs s \<and> valid_kernel_mappings s \<and> (\<exists>dev pd_cap. (\<exists>a b. cte_wp_at ((=) pd_cap) (a, b) s) \<and> (\<exists>asid. pd_cap = ArchObjectCap (PageDirectoryCap (fst (xa, x)) (Some asid)) \<and> args ! 0 < kernel_base \<and> (\<exists>rights'. v = ArchObjectCap (PageCap dev word rights' vmpage_size (Some (asid, args ! 0)))))))) \<and> cte_wp_at (\<lambda>a. \<exists>dev p R sz m. a = ArchObjectCap (PageCap dev p R sz m)) slot s \<and> valid_arch_state s \<and> valid_vspace_objs s \<and> valid_vs_lookup s \<and> unique_table_refs (caps_of_state s) \<and> pspace_aligned s \<and> valid_objs s \<and> valid_kernel_mappings s \<and> (\<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap (fst (xa, x)) (Some (snd (xa, x)))))) (a, b) s) \<and> args ! 0 < kernel_base \<and> valid_arch_state s \<and> valid_vspace_objs s \<and> equal_kernel_mappings s \<and> pspace_aligned s \<and> valid_global_objs s \<and> data_at vmpage_size word s \<and> vmsz_aligned (addrFromPPtr word) vmpage_size \<and> args ! 0 < kernel_base \<and> s \<turnstile> ArchObjectCap (PageCap dev word rights vmpage_size (Some (snd (xa, x), args ! 0))) \<and> snd (xa, x) \<le> mask local.asid_bits \<and> snd (xa, x) \<noteq> 0 \<and> invs s \<and> is_aligned (fst (xa, x)) pd_bits \<and> args ! 0 < kernel_base \<and> (\<exists>v. vspace_at_asid (snd (xa, x)) v s)))) s))))
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>dev word rights vmpage_size s aa b ys xa xc ref. \<lbrakk>arch_cap = PageCap dev word rights vmpage_size (Some (xc, args ! 0)); invocation_type label = ArchInvocationLabel ARMPageMap; invs s; s \<turnstile> ArchObjectCap (PageCap dev word rights vmpage_size (Some (xc, args ! 0))); caps_of_state s slot = Some (ArchObjectCap (PageCap dev word rights vmpage_size (Some (xc, args ! 0)))); 2 < length args; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; caps_of_state s (aa, b) = Some (ArchObjectCap (PageDirectoryCap xa (Some xc))); \<forall>x\<in>set ys. caps_of_state s (snd x) = Some (fst x); s \<turnstile> ArchObjectCap (PageDirectoryCap xa (Some xc)); vspace_at_asid xc xa s; typ_at (AArch APageDirectory) xa s; (ref \<rhd> xa) s; vmsz_aligned (args ! 0) vmpage_size\<rbrakk> \<Longrightarrow> cte_wp_at (is_arch_update (ArchObjectCap (PageCap dev word rights vmpage_size (Some (xc, args ! 0))))) slot s \<and> (cte_wp_at (\<lambda>c. vs_cap_ref c = None) slot s \<or> valid_arch_state s \<and> valid_vs_lookup s \<and> unique_table_refs (caps_of_state s) \<and> pspace_aligned s \<and> valid_objs s \<and> valid_kernel_mappings s \<and> (\<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (a, b) s) \<and> args ! 0 < kernel_base) \<and> cte_wp_at (\<lambda>a. \<exists>dev p R sz m. a = ArchObjectCap (PageCap dev p R sz m)) slot s \<and> valid_arch_state s \<and> valid_vs_lookup s \<and> unique_table_refs (caps_of_state s) \<and> pspace_aligned s \<and> valid_objs s \<and> valid_kernel_mappings s \<and> (\<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (a, b) s) \<and> args ! 0 < kernel_base \<and> valid_arch_state s \<and> equal_kernel_mappings s \<and> pspace_aligned s \<and> valid_global_objs s \<and> data_at vmpage_size word s \<and> vmsz_aligned (addrFromPPtr word) vmpage_size \<and> args ! 0 < kernel_base \<and> xc \<le> mask local.asid_bits \<and> xc \<noteq> 0 \<and> is_aligned xa pd_bits \<and> args ! 0 < kernel_base \<and> (\<exists>v. vspace_at_asid xc v s)
 2. \<And>dev word rights vmpage_size s aa b ys xa xc ref. \<lbrakk>arch_cap = PageCap dev word rights vmpage_size None; invocation_type label = ArchInvocationLabel ARMPageMap; invs s; s \<turnstile> ArchObjectCap (PageCap dev word rights vmpage_size None); caps_of_state s slot = Some (ArchObjectCap (PageCap dev word rights vmpage_size None)); 2 < length args; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; caps_of_state s (aa, b) = Some (ArchObjectCap (PageDirectoryCap xa (Some xc))); \<forall>x\<in>set ys. caps_of_state s (snd x) = Some (fst x); s \<turnstile> ArchObjectCap (PageDirectoryCap xa (Some xc)); \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize vmpage_size - 1; vspace_at_asid xc xa s; typ_at (AArch APageDirectory) xa s; (ref \<rhd> xa) s; vmsz_aligned (args ! 0) vmpage_size\<rbrakk> \<Longrightarrow> cte_wp_at (is_arch_update (ArchObjectCap (PageCap dev word rights vmpage_size (Some (xc, args ! 0))))) slot s \<and> cte_wp_at (\<lambda>c. vs_cap_ref c = None) slot s \<and> cte_wp_at is_pg_cap slot s \<and> valid_arch_state s \<and> valid_vs_lookup s \<and> unique_table_refs (caps_of_state s) \<and> pspace_aligned s \<and> valid_objs s \<and> valid_kernel_mappings s \<and> (\<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (a, b) s) \<and> args ! 0 < kernel_base \<and> valid_arch_state s \<and> equal_kernel_mappings s \<and> pspace_aligned s \<and> valid_global_objs s \<and> data_at vmpage_size word s \<and> vmsz_aligned (addrFromPPtr word) vmpage_size \<and> args ! 0 < kernel_base \<and> s \<turnstile> ArchObjectCap (PageCap dev word rights vmpage_size (Some (xc, args ! 0))) \<and> xc \<le> mask local.asid_bits \<and> xc \<noteq> 0 \<and> is_aligned xa pd_bits \<and> args ! 0 < kernel_base \<and> (\<exists>v. vspace_at_asid xc v s)
 3. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 2. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label = ArchInvocationLabel ARMPageUnmap\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label = ArchInvocationLabel ARMPageUnmap\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) \<lbrace>valid_arch_inv\<rbrace>, -
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>x31 x32 x33 x34 x35 s. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label = ArchInvocationLabel ARMPageUnmap; (invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))) s\<rbrakk> \<Longrightarrow> valid_arch_inv (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) s
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>x31 x32 x33 x34 x35 s. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label = ArchInvocationLabel ARMPageUnmap; invs s; s \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 x35); cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x)\<rbrakk> \<Longrightarrow> case x35 of None \<Rightarrow> True | Some x \<Rightarrow> valid_unmap x34 x
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>x31 x32 x33 x34 x35 s. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label = ArchInvocationLabel ARMPageUnmap; invs s; s \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 x35); cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot s\<rbrakk> \<Longrightarrow> case x35 of None \<Rightarrow> True | Some x \<Rightarrow> valid_unmap x34 x
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>x31 x32 x33 x34 s a b. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 (Some (a, b)); invocation_type label = ArchInvocationLabel ARMPageUnmap; invs s; s \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b))); cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b))))) slot s\<rbrakk> \<Longrightarrow> valid_unmap x34 (a, b)
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>x31 x32 x33 x34 s a b. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 (Some (a, b)); invocation_type label = ArchInvocationLabel ARMPageUnmap; invs s; cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b))))) slot s; is_aligned x32 (pageBitsForSize x34); pageBitsForSize x34 < word_bits; if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned b x34; b < kernel_base\<rbrakk> \<Longrightarrow> valid_unmap x34 (a, b)
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>x31 x32 x33 x34 s a b. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 (Some (a, b)); invocation_type label = ArchInvocationLabel ARMPageUnmap; invs s; cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (a, b))))) slot s; is_aligned x32 (pageBitsForSize x34); pageBitsForSize x34 < word_bits; if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; 0 < a; a < 2 ^ local.asid_bits; vmsz_aligned b x34; b < kernel_base\<rbrakk> \<Longrightarrow> is_aligned b pageBits \<and> (x34 = ARMSuperSection \<longrightarrow> is_aligned b 24) \<and> (x34 = ARMLargePage \<longrightarrow> is_aligned b 16) \<and> (x34 = ARMSection \<longrightarrow> is_aligned b 20)
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 2. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; isPageFlushLabel (invocation_type label)\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; \<not> isPageFlushLabel (invocation_type label)\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; isPageFlushLabel (invocation_type label)\<rbrakk> \<Longrightarrow> \<lbrace>?P'3010 x31 x32 x33 x34 x35\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 2. \<And>x31 x32 x33 x34 x35 s. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; isPageFlushLabel (invocation_type label); (invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))) s\<rbrakk> \<Longrightarrow> ?P'3010 x31 x32 x33 x34 x35 s
 3. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; \<not> isPageFlushLabel (invocation_type label)\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; isPageFlushLabel (invocation_type label)\<rbrakk> \<Longrightarrow> \<lbrace>?P'3010 x31 x32 x33 x34 x35\<rbrace> if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage \<lbrace>valid_arch_inv\<rbrace>, -
 2. \<And>x31 x32 x33 x34 x35 s. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; isPageFlushLabel (invocation_type label); (invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))) s\<rbrakk> \<Longrightarrow> ?P'3010 x31 x32 x33 x34 x35 s
 3. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; \<not> isPageFlushLabel (invocation_type label)\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 5. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (7 subgoals):
 1. \<And>x31 x32 x33 x34 x35 p. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; isPageFlushLabel (invocation_type label); Suc 0 < length args\<rbrakk> \<Longrightarrow> \<lbrace>?P'3026 x31 x32 x33 x34 x35 p\<rbrace> find_pd_for_asid (fst p) \<lbrace>\<lambda>rv. valid_arch_inv (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) rv (fst p)))\<rbrace>, -
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; isPageFlushLabel (invocation_type label); Suc 0 < length args\<rbrakk> \<Longrightarrow> \<lbrace>?Qa3016 x31 x32 x33 x34 x35\<rbrace> case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x \<lbrace>\<lambda>p s. True \<and> ?P'3026 x31 x32 x33 x34 x35 p s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; isPageFlushLabel (invocation_type label); \<not> Suc 0 < length args\<rbrakk> \<Longrightarrow> \<lbrace>?R3016 x31 x32 x33 x34 x35\<rbrace> throwError TruncatedMessage \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x31 x32 x33 x34 x35 s. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; isPageFlushLabel (invocation_type label); (invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))) s\<rbrakk> \<Longrightarrow> (Suc 0 < length args \<longrightarrow> ?Qa3016 x31 x32 x33 x34 x35 s) \<and> (\<not> Suc 0 < length args \<longrightarrow> ?R3016 x31 x32 x33 x34 x35 s)
 5. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; \<not> isPageFlushLabel (invocation_type label)\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 6. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 7. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (7 subgoals):
 1. \<And>x31 x32 x33 x34 x35 p. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; isPageFlushLabel (invocation_type label); Suc 0 < length args\<rbrakk> \<Longrightarrow> \<lbrace>?P'3026 x31 x32 x33 x34 x35 p\<rbrace> find_pd_for_asid (fst p) \<lbrace>\<lambda>rv s. vspace_at_asid (fst p) rv s \<and> fst p \<le> mask local.asid_bits \<and> fst p \<noteq> 0\<rbrace>, -
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; isPageFlushLabel (invocation_type label); Suc 0 < length args\<rbrakk> \<Longrightarrow> \<lbrace>?Qa3016 x31 x32 x33 x34 x35\<rbrace> case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x \<lbrace>\<lambda>p s. True \<and> ?P'3026 x31 x32 x33 x34 x35 p s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; isPageFlushLabel (invocation_type label); \<not> Suc 0 < length args\<rbrakk> \<Longrightarrow> \<lbrace>?R3016 x31 x32 x33 x34 x35\<rbrace> throwError TruncatedMessage \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x31 x32 x33 x34 x35 s. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; isPageFlushLabel (invocation_type label); (invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))) s\<rbrakk> \<Longrightarrow> (Suc 0 < length args \<longrightarrow> ?Qa3016 x31 x32 x33 x34 x35 s) \<and> (\<not> Suc 0 < length args \<longrightarrow> ?R3016 x31 x32 x33 x34 x35 s)
 5. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; \<not> isPageFlushLabel (invocation_type label)\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 6. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 7. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>x31 x32 x33 x34 x35 s. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; isPageFlushLabel (invocation_type label); (invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))) s\<rbrakk> \<Longrightarrow> (Suc 0 < length args \<longrightarrow> True \<and> True \<and> True \<and> (x35 = None \<longrightarrow> True) \<and> (\<forall>x. x35 = Some x \<longrightarrow> fst x \<le> mask local.asid_bits \<and> fst x \<noteq> 0)) \<and> (\<not> Suc 0 < length args \<longrightarrow> True)
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; \<not> isPageFlushLabel (invocation_type label)\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; \<not> isPageFlushLabel (invocation_type label)\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 2. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; \<not> isPageFlushLabel (invocation_type label); invocation_type label = ArchInvocationLabel ARMPageGetAddress\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; \<not> isPageFlushLabel (invocation_type label); invocation_type label \<noteq> ArchInvocationLabel ARMPageGetAddress\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress); invocation_type label = ArchInvocationLabel ARMPageGetAddress\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> returnOk (InvokePage (PageGetAddr x32)) \<lbrace>valid_arch_inv\<rbrace>, -
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; \<not> isPageFlushLabel (invocation_type label); invocation_type label \<noteq> ArchInvocationLabel ARMPageGetAddress\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>x31 x32 x33 x34 x35 s. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress); invocation_type label = ArchInvocationLabel ARMPageGetAddress; (invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))) s\<rbrakk> \<Longrightarrow> valid_arch_inv (InvokePage (PageGetAddr x32)) s
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; \<not> isPageFlushLabel (invocation_type label); invocation_type label \<noteq> ArchInvocationLabel ARMPageGetAddress\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; \<not> isPageFlushLabel (invocation_type label); invocation_type label \<noteq> ArchInvocationLabel ARMPageGetAddress\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> excaps \<noteq> [] then doE p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case x35 of None \<Rightarrow> doE vtop <- returnOk (args ! 0 + (1 << pageBitsForSize x34) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> snd p) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> args ! 0) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment x34 (args ! 0);
entries <- create_mapping_entries (addrFromPPtr x32) (args ! 0) x34 (mask_vm_rights x33 (data_to_rights (args ! Suc 0))) (attribs_from_word (args ! 2)) (fst p);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd p) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (snd p, args ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap x31 x32 x33 x34 x35) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length args then doE p <- case x35 of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst p));
y <- whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize x34 \<le> args ! 0 \<or> 2 ^ pageBitsForSize x34 < args ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (args ! 0 + snd p) (args ! Suc 0 + snd p - 1) (addrFromPPtr x32 + args ! 0) pd (fst p)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr x32)) else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 2. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; \<not> isPageFlushLabel (invocation_type label); invocation_type label \<noteq> ArchInvocationLabel ARMPageGetAddress\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))\<rbrace> throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 2. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>x31 x32 x33 x34 x35 s. \<lbrakk>arch_cap = PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; \<not> isPageFlushLabel (invocation_type label); invocation_type label \<noteq> ArchInvocationLabel ARMPageGetAddress; (invs and valid_cap (ArchObjectCap (PageCap x31 x32 x33 x34 x35)) and cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 x35))) slot and (\<lambda>s. \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x))) s\<rbrakk> \<Longrightarrow> True
 2. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 3. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, -
 2. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>x41 x42. arch_cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageTableCap x41 x42)) and cte_wp_at ((=) (ArchObjectCap (PageTableCap x41 x42))) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageTableMap then if Suc 0 < length args \<and> excaps \<noteq> [] then doE y <- whenE (\<exists>a b. x42 = Some (a, b)) (throwError (InvalidCapability 0));
p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- whenE (kernel_base \<le> args ! 0) (throwError (InvalidArgument 0));
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
oldpde <- liftE (get_master_pde (fst p + (args ! 0 >> 20 << 2)));
y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (InvokePageTable (PageTableMap (ArchObjectCap (PageTableCap x41 (Some (snd p, args ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr x41) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) (fst p + (args ! 0 >> 20 << 2))))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageTableUnmap then doE final <- liftE (gets (is_final_cap' (ArchObjectCap (PageTableCap x41 x42))));
y <- unlessE final (throwError RevokeFirst);
returnOk (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap x41 x42)) slot))
odE else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 2. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>word option. arch_cap = PageTableCap word option \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageTableCap word option)) and cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageTableMap then if Suc 0 < length args \<and> excaps \<noteq> [] then doE y <- whenE (\<exists>a b. option = Some (a, b)) (throwError (InvalidCapability 0));
p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- whenE (kernel_base \<le> args ! 0) (throwError (InvalidArgument 0));
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
oldpde <- liftE (get_master_pde (fst p + (args ! 0 >> 20 << 2)));
y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (InvokePageTable (PageTableMap (ArchObjectCap (PageTableCap word (Some (snd p, args ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) (fst p + (args ! 0 >> 20 << 2))))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageTableUnmap then doE final <- liftE (gets (is_final_cap' (ArchObjectCap (PageTableCap word option))));
y <- unlessE final (throwError RevokeFirst);
returnOk (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot))
odE else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 2. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>word option. arch_cap = PageTableCap word option \<Longrightarrow> \<lbrace>?P'3104 word option\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageTableMap then if Suc 0 < length args \<and> excaps \<noteq> [] then doE y <- whenE (\<exists>a b. option = Some (a, b)) (throwError (InvalidCapability 0));
p <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- whenE (kernel_base \<le> args ! 0) (throwError (InvalidArgument 0));
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability (Suc 0)));
oldpde <- liftE (get_master_pde (fst p + (args ! 0 >> 20 << 2)));
y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (InvokePageTable (PageTableMap (ArchObjectCap (PageTableCap word (Some (snd p, args ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) (fst p + (args ! 0 >> 20 << 2))))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageTableUnmap then doE final <- liftE (gets (is_final_cap' (ArchObjectCap (PageTableCap word option))));
y <- unlessE final (throwError RevokeFirst);
returnOk (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot))
odE else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 2. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; (invs and valid_cap (ArchObjectCap (PageTableCap word option)) and cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)) s\<rbrakk> \<Longrightarrow> ?P'3104 word option s
 3. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (8 subgoals):
 1. \<And>word option p pd. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. ?P3167 word option () p () a pd\<rbrace> find_pd_for_asid (snd p) \<lbrace>\<lambda>a aa. (case pd (UCAST(32 \<rightarrow> 12) (a + (args ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (a + (args ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (a + (args ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE \<longrightarrow> ako_at (PageDirectory pd) (a + (args ! 0 >> 20 << 2) && ~~ mask pd_bits) aa \<longrightarrow> pde_at (a + (args ! 0 >> 20 << 2)) aa \<and> is_aligned (addrFromPPtr word) pt_bits \<and> typ_at (AArch APageTable) word aa \<and> aa \<turnstile> ArchObjectCap (PageTableCap word (Some (snd p, args ! 0 && ~~ mask 20))) \<and> cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (PageTableCap word (Some (snd p, args ! 0 && ~~ mask 20)))) c \<and> cap_asid c = None) slot aa \<and> empty_pde_at (a + (args ! 0 >> 20 << 2)) aa \<and> args ! 0 >> 20 = a + (args ! 0 >> 20 << 2) && mask pd_bits >> 2 \<and> ([VSRef (snd p && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (snd p))) None] \<rhd> (a + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)) aa \<and> pde_ref (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) = Some word \<and> (\<exists>ao. ako_at ao word aa \<and> valid_vspace_obj ao aa) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs \<and> is_pt_cap (ArchObjectCap (PageTableCap word (Some (snd p, args ! 0 && ~~ mask 20))))\<rbrace>, -
 2. \<And>word option y p. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?B3111 word option y p\<rbrace> whenE (kernel_base \<le> args ! 0) (throwError (InvalidArgument 0)) \<lbrace>\<lambda>ya s. True \<and> (\<forall>x. ?P3167 word option y p ya s x)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>word option y. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?B3110 word option y\<rbrace> case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1 \<lbrace>?B3111 word option y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>word option. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Qa3109 word option\<rbrace> whenE (\<exists>a b. option = Some (a, b)) (throwError (InvalidCapability 0)) \<lbrace>?B3110 word option\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>word option. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; \<not> (Suc 0 < length args \<and> excaps \<noteq> [])\<rbrakk> \<Longrightarrow> \<lbrace>?R3109 word option\<rbrace> throwError TruncatedMessage \<lbrace>valid_arch_inv\<rbrace>, -
 6. \<And>word option. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap\<rbrakk> \<Longrightarrow> \<lbrace>?R3108 word option\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageTableUnmap then doE final <- liftE (gets (is_final_cap' (ArchObjectCap (PageTableCap word option))));
y <- unlessE final (throwError RevokeFirst);
returnOk (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot))
odE else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 7. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; (invs and valid_cap (ArchObjectCap (PageTableCap word option)) and cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)) s\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> (Suc 0 < length args \<and> excaps \<noteq> [] \<longrightarrow> ?Qa3109 word option s) \<and> (\<not> (Suc 0 < length args \<and> excaps \<noteq> []) \<longrightarrow> ?R3109 word option s)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> ?R3108 word option s)
 8. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (9 subgoals):
 1. \<And>word option p pd rv s. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; ako_at (PageDirectory pd) (rv + (args ! 0 >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (args ! 0 >> 20 << 2) && mask pd_bits >> 2)) = InvalidPDE \<longrightarrow> ?L3175 word option p pd word option p pd rv s\<rbrakk> \<Longrightarrow> (case pd (UCAST(32 \<rightarrow> 12) (rv + (args ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (args ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (args ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE \<longrightarrow> ako_at (PageDirectory pd) (rv + (args ! 0 >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pde_at (rv + (args ! 0 >> 20 << 2)) s \<and> is_aligned (addrFromPPtr word) pt_bits \<and> typ_at (AArch APageTable) word s \<and> s \<turnstile> ArchObjectCap (PageTableCap word (Some (snd p, args ! 0 && ~~ mask 20))) \<and> cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (PageTableCap word (Some (snd p, args ! 0 && ~~ mask 20)))) c \<and> cap_asid c = None) slot s \<and> empty_pde_at (rv + (args ! 0 >> 20 << 2)) s \<and> args ! 0 >> 20 = rv + (args ! 0 >> 20 << 2) && mask pd_bits >> 2 \<and> ([VSRef (snd p && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (snd p))) None] \<rhd> (rv + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) = Some word \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs \<and> is_pt_cap (ArchObjectCap (PageTableCap word (Some (snd p, args ! 0 && ~~ mask 20))))
 2. \<And>word option p pd. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P3176 word option () p () pd\<rbrace> find_pd_for_asid (snd p) \<lbrace>\<lambda>a b. ako_at (PageDirectory pd) (a + (args ! 0 >> 20 << 2) && ~~ mask pd_bits) b \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (a + (args ! 0 >> 20 << 2) && mask pd_bits >> 2)) = InvalidPDE \<longrightarrow> ?L3175 word option p pd word option p pd a b\<rbrace>, -
 3. \<And>word option y p. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?B3111 word option y p\<rbrace> whenE (kernel_base \<le> args ! 0) (throwError (InvalidArgument 0)) \<lbrace>\<lambda>ya s. True \<and> (\<forall>x. ?P3176 word option y p ya x s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>word option y. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?B3110 word option y\<rbrace> case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1 \<lbrace>?B3111 word option y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>word option. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Qa3109 word option\<rbrace> whenE (\<exists>a b. option = Some (a, b)) (throwError (InvalidCapability 0)) \<lbrace>?B3110 word option\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>word option. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; \<not> (Suc 0 < length args \<and> excaps \<noteq> [])\<rbrakk> \<Longrightarrow> \<lbrace>?R3109 word option\<rbrace> throwError TruncatedMessage \<lbrace>valid_arch_inv\<rbrace>, -
 7. \<And>word option. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap\<rbrakk> \<Longrightarrow> \<lbrace>?R3108 word option\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageTableUnmap then doE final <- liftE (gets (is_final_cap' (ArchObjectCap (PageTableCap word option))));
y <- unlessE final (throwError RevokeFirst);
returnOk (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot))
odE else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 8. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; (invs and valid_cap (ArchObjectCap (PageTableCap word option)) and cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)) s\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> (Suc 0 < length args \<and> excaps \<noteq> [] \<longrightarrow> ?Qa3109 word option s) \<and> (\<not> (Suc 0 < length args \<and> excaps \<noteq> []) \<longrightarrow> ?R3109 word option s)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> ?R3108 word option s)
 9. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (9 subgoals):
 1. \<And>word option p pd rv s. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; ako_at (PageDirectory pd) (rv + (args ! 0 >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (args ! 0 >> 20 << 2) && mask pd_bits >> 2)) = InvalidPDE \<longrightarrow> ?L3175 word option p pd word option p pd rv s; (case pd (UCAST(32 \<rightarrow> 12) (rv + (args ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (args ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (args ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE; ako_at (PageDirectory pd) (rv + (args ! 0 >> 20 << 2) && ~~ mask pd_bits) s\<rbrakk> \<Longrightarrow> pde_at (rv + (args ! 0 >> 20 << 2)) s \<and> is_aligned (addrFromPPtr word) pt_bits \<and> typ_at (AArch APageTable) word s \<and> s \<turnstile> ArchObjectCap (PageTableCap word (Some (snd p, args ! 0 && ~~ mask 20))) \<and> cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (PageTableCap word (Some (snd p, args ! 0 && ~~ mask 20)))) c \<and> cap_asid c = None) slot s \<and> empty_pde_at (rv + (args ! 0 >> 20 << 2)) s \<and> args ! 0 >> 20 = rv + (args ! 0 >> 20 << 2) && mask pd_bits >> 2 \<and> ([VSRef (snd p && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (snd p))) None] \<rhd> (rv + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) = Some word \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs \<and> is_pt_cap (ArchObjectCap (PageTableCap word (Some (snd p, args ! 0 && ~~ mask 20))))
 2. \<And>word option p pd. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P3176 word option () p () pd\<rbrace> find_pd_for_asid (snd p) \<lbrace>\<lambda>a b. ako_at (PageDirectory pd) (a + (args ! 0 >> 20 << 2) && ~~ mask pd_bits) b \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (a + (args ! 0 >> 20 << 2) && mask pd_bits >> 2)) = InvalidPDE \<longrightarrow> ?L3175 word option p pd word option p pd a b\<rbrace>, -
 3. \<And>word option y p. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?B3111 word option y p\<rbrace> whenE (kernel_base \<le> args ! 0) (throwError (InvalidArgument 0)) \<lbrace>\<lambda>ya s. True \<and> (\<forall>x. ?P3176 word option y p ya x s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>word option y. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?B3110 word option y\<rbrace> case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1 \<lbrace>?B3111 word option y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>word option. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Qa3109 word option\<rbrace> whenE (\<exists>a b. option = Some (a, b)) (throwError (InvalidCapability 0)) \<lbrace>?B3110 word option\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>word option. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; \<not> (Suc 0 < length args \<and> excaps \<noteq> [])\<rbrakk> \<Longrightarrow> \<lbrace>?R3109 word option\<rbrace> throwError TruncatedMessage \<lbrace>valid_arch_inv\<rbrace>, -
 7. \<And>word option. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap\<rbrakk> \<Longrightarrow> \<lbrace>?R3108 word option\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageTableUnmap then doE final <- liftE (gets (is_final_cap' (ArchObjectCap (PageTableCap word option))));
y <- unlessE final (throwError RevokeFirst);
returnOk (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot))
odE else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 8. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; (invs and valid_cap (ArchObjectCap (PageTableCap word option)) and cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)) s\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> (Suc 0 < length args \<and> excaps \<noteq> [] \<longrightarrow> ?Qa3109 word option s) \<and> (\<not> (Suc 0 < length args \<and> excaps \<noteq> []) \<longrightarrow> ?R3109 word option s)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> ?R3108 word option s)
 9. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (10 subgoals):
 1. \<And>word option p pd rv s. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; (case pd (UCAST(32 \<rightarrow> 12) (rv + (args ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (args ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (args ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE; ako_at (PageDirectory pd) (rv + (args ! 0 >> 20 << 2) && ~~ mask pd_bits) s\<rbrakk> \<Longrightarrow> ako_at (PageDirectory pd) (rv + (args ! 0 >> 20 << 2) && ~~ mask pd_bits) s
 2. \<And>word option p pd rv s. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; (case pd (UCAST(32 \<rightarrow> 12) (rv + (args ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (args ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (args ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE; ako_at (PageDirectory pd) (rv + (args ! 0 >> 20 << 2) && ~~ mask pd_bits) s; pd (UCAST(32 \<rightarrow> 12) (rv + (args ! 0 >> 20 << 2) && mask pd_bits >> 2)) = InvalidPDE \<longrightarrow> ?L3175 word option p pd word option p pd rv s\<rbrakk> \<Longrightarrow> pde_at (rv + (args ! 0 >> 20 << 2)) s \<and> is_aligned (addrFromPPtr word) pt_bits \<and> typ_at (AArch APageTable) word s \<and> s \<turnstile> ArchObjectCap (PageTableCap word (Some (snd p, args ! 0 && ~~ mask 20))) \<and> cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (PageTableCap word (Some (snd p, args ! 0 && ~~ mask 20)))) c \<and> cap_asid c = None) slot s \<and> empty_pde_at (rv + (args ! 0 >> 20 << 2)) s \<and> args ! 0 >> 20 = rv + (args ! 0 >> 20 << 2) && mask pd_bits >> 2 \<and> ([VSRef (snd p && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (snd p))) None] \<rhd> (rv + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) = Some word \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs \<and> is_pt_cap (ArchObjectCap (PageTableCap word (Some (snd p, args ! 0 && ~~ mask 20))))
 3. \<And>word option p pd. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P3176 word option () p () pd\<rbrace> find_pd_for_asid (snd p) \<lbrace>\<lambda>a b. ako_at (PageDirectory pd) (a + (args ! 0 >> 20 << 2) && ~~ mask pd_bits) b \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (a + (args ! 0 >> 20 << 2) && mask pd_bits >> 2)) = InvalidPDE \<longrightarrow> ?L3175 word option p pd word option p pd a b\<rbrace>, -
 4. \<And>word option y p. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?B3111 word option y p\<rbrace> whenE (kernel_base \<le> args ! 0) (throwError (InvalidArgument 0)) \<lbrace>\<lambda>ya s. True \<and> (\<forall>x. ?P3176 word option y p ya x s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>word option y. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?B3110 word option y\<rbrace> case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1 \<lbrace>?B3111 word option y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>word option. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Qa3109 word option\<rbrace> whenE (\<exists>a b. option = Some (a, b)) (throwError (InvalidCapability 0)) \<lbrace>?B3110 word option\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>word option. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; \<not> (Suc 0 < length args \<and> excaps \<noteq> [])\<rbrakk> \<Longrightarrow> \<lbrace>?R3109 word option\<rbrace> throwError TruncatedMessage \<lbrace>valid_arch_inv\<rbrace>, -
 8. \<And>word option. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap\<rbrakk> \<Longrightarrow> \<lbrace>?R3108 word option\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageTableUnmap then doE final <- liftE (gets (is_final_cap' (ArchObjectCap (PageTableCap word option))));
y <- unlessE final (throwError RevokeFirst);
returnOk (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot))
odE else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 9. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; (invs and valid_cap (ArchObjectCap (PageTableCap word option)) and cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)) s\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> (Suc 0 < length args \<and> excaps \<noteq> [] \<longrightarrow> ?Qa3109 word option s) \<and> (\<not> (Suc 0 < length args \<and> excaps \<noteq> []) \<longrightarrow> ?R3109 word option s)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> ?R3108 word option s)
 10. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (9 subgoals):
 1. \<And>word option p pd rv s. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; (case pd (UCAST(32 \<rightarrow> 12) (rv + (args ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (args ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (args ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE; ako_at (PageDirectory pd) (rv + (args ! 0 >> 20 << 2) && ~~ mask pd_bits) s; pd (UCAST(32 \<rightarrow> 12) (rv + (args ! 0 >> 20 << 2) && mask pd_bits >> 2)) = InvalidPDE \<longrightarrow> ?L3175 word option p pd word option p pd rv s\<rbrakk> \<Longrightarrow> pde_at (rv + (args ! 0 >> 20 << 2)) s \<and> is_aligned (addrFromPPtr word) pt_bits \<and> typ_at (AArch APageTable) word s \<and> s \<turnstile> ArchObjectCap (PageTableCap word (Some (snd p, args ! 0 && ~~ mask 20))) \<and> cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (PageTableCap word (Some (snd p, args ! 0 && ~~ mask 20)))) c \<and> cap_asid c = None) slot s \<and> empty_pde_at (rv + (args ! 0 >> 20 << 2)) s \<and> args ! 0 >> 20 = rv + (args ! 0 >> 20 << 2) && mask pd_bits >> 2 \<and> ([VSRef (snd p && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (snd p))) None] \<rhd> (rv + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) = Some word \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs \<and> is_pt_cap (ArchObjectCap (PageTableCap word (Some (snd p, args ! 0 && ~~ mask 20))))
 2. \<And>word option p pd. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P3176 word option () p () pd\<rbrace> find_pd_for_asid (snd p) \<lbrace>\<lambda>a b. ako_at (PageDirectory pd) (a + (args ! 0 >> 20 << 2) && ~~ mask pd_bits) b \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (a + (args ! 0 >> 20 << 2) && mask pd_bits >> 2)) = InvalidPDE \<longrightarrow> ?L3175 word option p pd word option p pd a b\<rbrace>, -
 3. \<And>word option y p. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?B3111 word option y p\<rbrace> whenE (kernel_base \<le> args ! 0) (throwError (InvalidArgument 0)) \<lbrace>\<lambda>ya s. True \<and> (\<forall>x. ?P3176 word option y p ya x s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>word option y. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?B3110 word option y\<rbrace> case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1 \<lbrace>?B3111 word option y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>word option. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Qa3109 word option\<rbrace> whenE (\<exists>a b. option = Some (a, b)) (throwError (InvalidCapability 0)) \<lbrace>?B3110 word option\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>word option. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; \<not> (Suc 0 < length args \<and> excaps \<noteq> [])\<rbrakk> \<Longrightarrow> \<lbrace>?R3109 word option\<rbrace> throwError TruncatedMessage \<lbrace>valid_arch_inv\<rbrace>, -
 7. \<And>word option. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap\<rbrakk> \<Longrightarrow> \<lbrace>?R3108 word option\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageTableUnmap then doE final <- liftE (gets (is_final_cap' (ArchObjectCap (PageTableCap word option))));
y <- unlessE final (throwError RevokeFirst);
returnOk (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot))
odE else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 8. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; (invs and valid_cap (ArchObjectCap (PageTableCap word option)) and cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)) s\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> (Suc 0 < length args \<and> excaps \<noteq> [] \<longrightarrow> ?Qa3109 word option s) \<and> (\<not> (Suc 0 < length args \<and> excaps \<noteq> []) \<longrightarrow> ?R3109 word option s)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> ?R3108 word option s)
 9. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (10 subgoals):
 1. \<And>word option p pd rv s. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; (case pd (UCAST(32 \<rightarrow> 12) (rv + (args ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (args ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (args ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE; ako_at (PageDirectory pd) (rv + (args ! 0 >> 20 << 2) && ~~ mask pd_bits) s\<rbrakk> \<Longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (args ! 0 >> 20 << 2) && mask pd_bits >> 2)) = InvalidPDE
 2. \<And>word option p pd rv s. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; (case pd (UCAST(32 \<rightarrow> 12) (rv + (args ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (args ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (args ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE; ako_at (PageDirectory pd) (rv + (args ! 0 >> 20 << 2) && ~~ mask pd_bits) s; ?L3183 word word option option p p pd pd rv s\<rbrakk> \<Longrightarrow> pde_at (rv + (args ! 0 >> 20 << 2)) s \<and> is_aligned (addrFromPPtr word) pt_bits \<and> typ_at (AArch APageTable) word s \<and> s \<turnstile> ArchObjectCap (PageTableCap word (Some (snd p, args ! 0 && ~~ mask 20))) \<and> cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (PageTableCap word (Some (snd p, args ! 0 && ~~ mask 20)))) c \<and> cap_asid c = None) slot s \<and> empty_pde_at (rv + (args ! 0 >> 20 << 2)) s \<and> args ! 0 >> 20 = rv + (args ! 0 >> 20 << 2) && mask pd_bits >> 2 \<and> ([VSRef (snd p && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (snd p))) None] \<rhd> (rv + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) = Some word \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs \<and> is_pt_cap (ArchObjectCap (PageTableCap word (Some (snd p, args ! 0 && ~~ mask 20))))
 3. \<And>word option p pd. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P3176 word option () p () pd\<rbrace> find_pd_for_asid (snd p) \<lbrace>\<lambda>a b. ako_at (PageDirectory pd) (a + (args ! 0 >> 20 << 2) && ~~ mask pd_bits) b \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (a + (args ! 0 >> 20 << 2) && mask pd_bits >> 2)) = InvalidPDE \<longrightarrow> ?L3183 word word option option p p pd pd a b\<rbrace>, -
 4. \<And>word option y p. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?B3111 word option y p\<rbrace> whenE (kernel_base \<le> args ! 0) (throwError (InvalidArgument 0)) \<lbrace>\<lambda>ya s. True \<and> (\<forall>x. ?P3176 word option y p ya x s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>word option y. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?B3110 word option y\<rbrace> case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1 \<lbrace>?B3111 word option y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>word option. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Qa3109 word option\<rbrace> whenE (\<exists>a b. option = Some (a, b)) (throwError (InvalidCapability 0)) \<lbrace>?B3110 word option\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>word option. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; \<not> (Suc 0 < length args \<and> excaps \<noteq> [])\<rbrakk> \<Longrightarrow> \<lbrace>?R3109 word option\<rbrace> throwError TruncatedMessage \<lbrace>valid_arch_inv\<rbrace>, -
 8. \<And>word option. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap\<rbrakk> \<Longrightarrow> \<lbrace>?R3108 word option\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageTableUnmap then doE final <- liftE (gets (is_final_cap' (ArchObjectCap (PageTableCap word option))));
y <- unlessE final (throwError RevokeFirst);
returnOk (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot))
odE else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 9. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; (invs and valid_cap (ArchObjectCap (PageTableCap word option)) and cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)) s\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> (Suc 0 < length args \<and> excaps \<noteq> [] \<longrightarrow> ?Qa3109 word option s) \<and> (\<not> (Suc 0 < length args \<and> excaps \<noteq> []) \<longrightarrow> ?R3109 word option s)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> ?R3108 word option s)
 10. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (9 subgoals):
 1. \<And>word option p pd rv s. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; (case pd (UCAST(32 \<rightarrow> 12) (rv + (args ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (args ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (args ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE; ako_at (PageDirectory pd) (rv + (args ! 0 >> 20 << 2) && ~~ mask pd_bits) s; ?L3183 word word option option p p pd pd rv s\<rbrakk> \<Longrightarrow> pde_at (rv + (args ! 0 >> 20 << 2)) s \<and> is_aligned (addrFromPPtr word) pt_bits \<and> typ_at (AArch APageTable) word s \<and> s \<turnstile> ArchObjectCap (PageTableCap word (Some (snd p, args ! 0 && ~~ mask 20))) \<and> cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (PageTableCap word (Some (snd p, args ! 0 && ~~ mask 20)))) c \<and> cap_asid c = None) slot s \<and> empty_pde_at (rv + (args ! 0 >> 20 << 2)) s \<and> args ! 0 >> 20 = rv + (args ! 0 >> 20 << 2) && mask pd_bits >> 2 \<and> ([VSRef (snd p && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (snd p))) None] \<rhd> (rv + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) = Some word \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs \<and> is_pt_cap (ArchObjectCap (PageTableCap word (Some (snd p, args ! 0 && ~~ mask 20))))
 2. \<And>word option p pd. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P3176 word option () p () pd\<rbrace> find_pd_for_asid (snd p) \<lbrace>\<lambda>a b. ako_at (PageDirectory pd) (a + (args ! 0 >> 20 << 2) && ~~ mask pd_bits) b \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (a + (args ! 0 >> 20 << 2) && mask pd_bits >> 2)) = InvalidPDE \<longrightarrow> ?L3183 word word option option p p pd pd a b\<rbrace>, -
 3. \<And>word option y p. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?B3111 word option y p\<rbrace> whenE (kernel_base \<le> args ! 0) (throwError (InvalidArgument 0)) \<lbrace>\<lambda>ya s. True \<and> (\<forall>x. ?P3176 word option y p ya x s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>word option y. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?B3110 word option y\<rbrace> case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1 \<lbrace>?B3111 word option y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>word option. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Qa3109 word option\<rbrace> whenE (\<exists>a b. option = Some (a, b)) (throwError (InvalidCapability 0)) \<lbrace>?B3110 word option\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>word option. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; \<not> (Suc 0 < length args \<and> excaps \<noteq> [])\<rbrakk> \<Longrightarrow> \<lbrace>?R3109 word option\<rbrace> throwError TruncatedMessage \<lbrace>valid_arch_inv\<rbrace>, -
 7. \<And>word option. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap\<rbrakk> \<Longrightarrow> \<lbrace>?R3108 word option\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageTableUnmap then doE final <- liftE (gets (is_final_cap' (ArchObjectCap (PageTableCap word option))));
y <- unlessE final (throwError RevokeFirst);
returnOk (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot))
odE else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 8. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; (invs and valid_cap (ArchObjectCap (PageTableCap word option)) and cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)) s\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> (Suc 0 < length args \<and> excaps \<noteq> [] \<longrightarrow> ?Qa3109 word option s) \<and> (\<not> (Suc 0 < length args \<and> excaps \<noteq> []) \<longrightarrow> ?R3109 word option s)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> ?R3108 word option s)
 9. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (8 subgoals):
 1. \<And>word option p pd. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?P3176 word option () p () pd\<rbrace> find_pd_for_asid (snd p) \<lbrace>\<lambda>a b. ako_at (PageDirectory pd) (a + (args ! 0 >> 20 << 2) && ~~ mask pd_bits) b \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (a + (args ! 0 >> 20 << 2) && mask pd_bits >> 2)) = InvalidPDE \<longrightarrow> pde_at (a + (args ! 0 >> 20 << 2)) b \<and> is_aligned (addrFromPPtr word) pt_bits \<and> typ_at (AArch APageTable) word b \<and> b \<turnstile> ArchObjectCap (PageTableCap word (Some (snd p, args ! 0 && ~~ mask 20))) \<and> cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (PageTableCap word (Some (snd p, args ! 0 && ~~ mask 20)))) c \<and> cap_asid c = None) slot b \<and> empty_pde_at (a + (args ! 0 >> 20 << 2)) b \<and> args ! 0 >> 20 = a + (args ! 0 >> 20 << 2) && mask pd_bits >> 2 \<and> ([VSRef (snd p && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (snd p))) None] \<rhd> (a + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)) b \<and> pde_ref (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) = Some word \<and> (\<exists>ao. ako_at ao word b \<and> valid_vspace_obj ao b) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs \<and> is_pt_cap (ArchObjectCap (PageTableCap word (Some (snd p, args ! 0 && ~~ mask 20))))\<rbrace>, -
 2. \<And>word option y p. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?B3111 word option y p\<rbrace> whenE (kernel_base \<le> args ! 0) (throwError (InvalidArgument 0)) \<lbrace>\<lambda>ya s. True \<and> (\<forall>x. ?P3176 word option y p ya x s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>word option y. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?B3110 word option y\<rbrace> case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1 \<lbrace>?B3111 word option y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>word option. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []\<rbrakk> \<Longrightarrow> \<lbrace>?Qa3109 word option\<rbrace> whenE (\<exists>a b. option = Some (a, b)) (throwError (InvalidCapability 0)) \<lbrace>?B3110 word option\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>word option. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; \<not> (Suc 0 < length args \<and> excaps \<noteq> [])\<rbrakk> \<Longrightarrow> \<lbrace>?R3109 word option\<rbrace> throwError TruncatedMessage \<lbrace>valid_arch_inv\<rbrace>, -
 6. \<And>word option. \<lbrakk>arch_cap = PageTableCap word option; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap\<rbrakk> \<Longrightarrow> \<lbrace>?R3108 word option\<rbrace> if invocation_type label = ArchInvocationLabel ARMPageTableUnmap then doE final <- liftE (gets (is_final_cap' (ArchObjectCap (PageTableCap word option))));
y <- unlessE final (throwError RevokeFirst);
returnOk (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot))
odE else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 7. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; (invs and valid_cap (ArchObjectCap (PageTableCap word option)) and cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)) s\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> (Suc 0 < length args \<and> excaps \<noteq> [] \<longrightarrow> ?Qa3109 word option s) \<and> (\<not> (Suc 0 < length args \<and> excaps \<noteq> []) \<longrightarrow> ?R3109 word option s)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> ?R3108 word option s)
 8. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; (invs and valid_cap (ArchObjectCap (PageTableCap word option)) and cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)) s\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> (Suc 0 < length args \<and> excaps \<noteq> [] \<longrightarrow> (\<nexists>a b. option = Some (a, b)) \<longrightarrow> True \<and> (fst (excaps ! 0) = NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. fst (excaps ! 0) = UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = EndpointCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = NotificationCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = CNodeCap x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ThreadCap x \<longrightarrow> True) \<and> (fst (excaps ! 0) = DomainCap \<longrightarrow> True) \<and> (fst (excaps ! 0) = IRQControlCap \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = ASIDPoolCap xa xb \<longrightarrow> True) \<and> (x = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>xa xb xc xd xe. x = PageCap xa xb xc xd xe \<longrightarrow> True) \<and> (\<forall>xa xb. x = PageTableCap xa xb \<longrightarrow> True) \<and> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (xb = None \<longrightarrow> True) \<and> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> args ! 0 \<longrightarrow> True \<and> (\<forall>xb. (valid_vspace_objs and pspace_aligned) s \<and> is_aligned (addrFromPPtr word) pt_bits \<and> typ_at (AArch APageTable) word s \<and> s \<turnstile> ArchObjectCap (PageTableCap word (Some (snd (xa, x), args ! 0 && ~~ mask 20))) \<and> cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (PageTableCap word (Some (snd (xa, x), args ! 0 && ~~ mask 20)))) c \<and> cap_asid c = None) slot s \<and> (pspace_aligned and valid_vspace_objs) s \<and> (pspace_aligned and valid_vspace_objs and K ([VSRef (snd (xa, x) && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (snd (xa, x)))) None] = [VSRef (snd (xa, x) && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of (snd (xa, x)))) None])) s \<and> pde_ref (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) = Some word \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs \<and> is_pt_cap (ArchObjectCap (PageTableCap word (Some (snd (xa, x), args ! 0 && ~~ mask 20))))))))) \<and> (\<not> (Suc 0 < length args \<and> excaps \<noteq> []) \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> True \<and> True \<and> (if is_final_cap' (ArchObjectCap (PageTableCap word option)) s then valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) else (\<lambda>s. True \<and> True)) s) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> True))
 2. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length args \<and> excaps \<noteq> [] \<longrightarrow> option = None \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> args ! 0 \<longrightarrow> valid_vspace_objs s \<and> pspace_aligned s \<and> is_aligned (addrFromPPtr word) pt_bits \<and> typ_at (AArch APageTable) word s \<and> s \<turnstile> ArchObjectCap (PageTableCap word (Some (x, args ! 0 && ~~ mask 20))) \<and> cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (PageTableCap word (Some (x, args ! 0 && ~~ mask 20)))) c \<and> cap_asid c = None) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pde_ref (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) = Some word \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs)))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s)
 2. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length args \<and> excaps \<noteq> [] \<longrightarrow> option = None \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> args ! 0 \<longrightarrow> valid_vspace_objs s \<and> pspace_aligned s \<and> is_aligned (addrFromPPtr word) pt_bits \<and> typ_at (AArch APageTable) word s \<and> s \<turnstile> ArchObjectCap (PageTableCap word (Some (x, args ! 0 && ~~ mask 20))) \<and> cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (PageTableCap word (Some (x, args ! 0 && ~~ mask 20)))) c \<and> cap_asid c = None) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pde_ref (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) = Some word \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs)))
 2. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s
 3. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>word s xa xc. \<lbrakk>arch_cap = PageTableCap word None; invs s; s \<turnstile> ArchObjectCap (PageTableCap word None); cte_wp_at ((=) (ArchObjectCap (PageTableCap word None))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xa (Some xc)); \<not> kernel_base \<le> args ! 0\<rbrakk> \<Longrightarrow> valid_vspace_objs s \<and> pspace_aligned s \<and> is_aligned (addrFromPPtr word) pt_bits \<and> typ_at (AArch APageTable) word s \<and> s \<turnstile> ArchObjectCap (PageTableCap word (Some (xc, args ! 0 && ~~ mask 20))) \<and> cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (PageTableCap word (Some (xc, args ! 0 && ~~ mask 20)))) c \<and> cap_asid c = None) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pde_ref (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) = Some word \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs
 2. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s
 3. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>word s xa xc. \<lbrakk>arch_cap = PageTableCap word None; invs s; s \<turnstile> ArchObjectCap (PageTableCap word None); cte_wp_at ((=) (ArchObjectCap (PageTableCap word None))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xa (Some xc)); \<not> kernel_base \<le> args ! 0\<rbrakk> \<Longrightarrow> pspace_aligned s \<and> is_aligned (addrFromPPtr word) pt_bits \<and> typ_at (AArch APageTable) word s \<and> s \<turnstile> ArchObjectCap (PageTableCap word (Some (xc, args ! 0 && ~~ mask 20))) \<and> cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (PageTableCap word (Some (xc, args ! 0 && ~~ mask 20)))) c \<and> cap_asid c = None) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pde_ref (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) = Some word \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs
 2. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s
 3. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>word s xa xc. \<lbrakk>arch_cap = PageTableCap word None; invs s; s \<turnstile> ArchObjectCap (PageTableCap word None); cte_wp_at ((=) (ArchObjectCap (PageTableCap word None))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xa (Some xc)); \<not> kernel_base \<le> args ! 0\<rbrakk> \<Longrightarrow> is_aligned (addrFromPPtr word) pt_bits \<and> typ_at (AArch APageTable) word s \<and> s \<turnstile> ArchObjectCap (PageTableCap word (Some (xc, args ! 0 && ~~ mask 20))) \<and> cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (PageTableCap word (Some (xc, args ! 0 && ~~ mask 20)))) c \<and> cap_asid c = None) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pde_ref (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) = Some word \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs
 2. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s
 3. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; s \<turnstile> ArchObjectCap (PageTableCap word None); cte_wp_at ((=) (ArchObjectCap (PageTableCap word None))) slot s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> is_aligned (addrFromPPtr word) pt_bits \<and> typ_at (AArch APageTable) word s \<and> s \<turnstile> ArchObjectCap (PageTableCap word (Some (xc, args ! 0 && ~~ mask 20))) \<and> cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (PageTableCap word (Some (xc, args ! 0 && ~~ mask 20)))) c \<and> cap_asid c = None) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pde_ref (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) = Some word \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs
 2. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s
 3. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; s \<turnstile> ArchObjectCap (PageTableCap word None); cte_wp_at ((=) (ArchObjectCap (PageTableCap word None))) slot s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s\<rbrakk> \<Longrightarrow> is_aligned (addrFromPPtr word) pt_bits \<and> typ_at (AArch APageTable) word s \<and> s \<turnstile> ArchObjectCap (PageTableCap word (Some (xc, args ! 0 && ~~ mask 20))) \<and> cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (PageTableCap word (Some (xc, args ! 0 && ~~ mask 20)))) c \<and> cap_asid c = None) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pde_ref (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) = Some word \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs
 2. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s
 3. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; s \<turnstile> ArchObjectCap (PageTableCap word None); cte_wp_at ((=) (ArchObjectCap (PageTableCap word None))) slot s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s\<rbrakk> \<Longrightarrow> is_aligned (addrFromPPtr word) pt_bits
 2. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; s \<turnstile> ArchObjectCap (PageTableCap word None); cte_wp_at ((=) (ArchObjectCap (PageTableCap word None))) slot s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s\<rbrakk> \<Longrightarrow> typ_at (AArch APageTable) word s \<and> s \<turnstile> ArchObjectCap (PageTableCap word (Some (xc, args ! 0 && ~~ mask 20))) \<and> cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (PageTableCap word (Some (xc, args ! 0 && ~~ mask 20)))) c \<and> cap_asid c = None) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pde_ref (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) = Some word \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs
 3. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; s \<turnstile> ArchObjectCap (PageTableCap word None); cte_wp_at ((=) (ArchObjectCap (PageTableCap word None))) slot s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s\<rbrakk> \<Longrightarrow> typ_at (AArch APageTable) word s \<and> s \<turnstile> ArchObjectCap (PageTableCap word (Some (xc, args ! 0 && ~~ mask 20))) \<and> cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (PageTableCap word (Some (xc, args ! 0 && ~~ mask 20)))) c \<and> cap_asid c = None) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pde_ref (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) = Some word \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs
 2. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s
 3. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; s \<turnstile> ArchObjectCap (PageTableCap word None); cte_wp_at ((=) (ArchObjectCap (PageTableCap word None))) slot s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s\<rbrakk> \<Longrightarrow> typ_at (AArch APageTable) word s
 2. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; s \<turnstile> ArchObjectCap (PageTableCap word None); cte_wp_at ((=) (ArchObjectCap (PageTableCap word None))) slot s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s\<rbrakk> \<Longrightarrow> s \<turnstile> ArchObjectCap (PageTableCap word (Some (xc, args ! 0 && ~~ mask 20))) \<and> cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (PageTableCap word (Some (xc, args ! 0 && ~~ mask 20)))) c \<and> cap_asid c = None) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pde_ref (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) = Some word \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs
 3. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; s \<turnstile> ArchObjectCap (PageTableCap word None); cte_wp_at ((=) (ArchObjectCap (PageTableCap word None))) slot s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s\<rbrakk> \<Longrightarrow> s \<turnstile> ArchObjectCap (PageTableCap word (Some (xc, args ! 0 && ~~ mask 20))) \<and> cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (PageTableCap word (Some (xc, args ! 0 && ~~ mask 20)))) c \<and> cap_asid c = None) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pde_ref (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) = Some word \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs
 2. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s
 3. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; s \<turnstile> ArchObjectCap (PageTableCap word None); cte_wp_at ((=) (ArchObjectCap (PageTableCap word None))) slot s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s\<rbrakk> \<Longrightarrow> s \<turnstile> ArchObjectCap (PageTableCap word (Some (xc, args ! 0 && ~~ mask 20)))
 2. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; s \<turnstile> ArchObjectCap (PageTableCap word None); cte_wp_at ((=) (ArchObjectCap (PageTableCap word None))) slot s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (PageTableCap word (Some (xc, args ! 0 && ~~ mask 20)))) c \<and> cap_asid c = None) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pde_ref (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) = Some word \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs
 3. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; s \<turnstile> ArchObjectCap (PageTableCap word None); invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; s \<turnstile> ArchObjectCap (PageDirectoryCap xa (Some xc)); s \<turnstile> ArchObjectCap (PageTableCap word None)\<rbrakk> \<Longrightarrow> s \<turnstile> ArchObjectCap (PageTableCap word (Some (xc, args ! 0 && ~~ mask 20)))
 2. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; s \<turnstile> ArchObjectCap (PageTableCap word None); cte_wp_at ((=) (ArchObjectCap (PageTableCap word None))) slot s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (PageTableCap word (Some (xc, args ! 0 && ~~ mask 20)))) c \<and> cap_asid c = None) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pde_ref (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) = Some word \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs
 3. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; s \<turnstile> ArchObjectCap (PageDirectoryCap xa (Some xc)); s \<turnstile> ArchObjectCap (PageTableCap word None)\<rbrakk> \<Longrightarrow> s \<turnstile> ArchObjectCap (PageTableCap word (Some (xc, args ! 0 && ~~ mask 20)))
 2. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; s \<turnstile> ArchObjectCap (PageTableCap word None); cte_wp_at ((=) (ArchObjectCap (PageTableCap word None))) slot s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (PageTableCap word (Some (xc, args ! 0 && ~~ mask 20)))) c \<and> cap_asid c = None) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pde_ref (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) = Some word \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs
 3. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; s \<turnstile> ArchObjectCap (PageTableCap word None); cte_wp_at ((=) (ArchObjectCap (PageTableCap word None))) slot s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (PageTableCap word (Some (xc, args ! 0 && ~~ mask 20)))) c \<and> cap_asid c = None) slot s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pde_ref (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) = Some word \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs
 2. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s
 3. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; s \<turnstile> ArchObjectCap (PageTableCap word None); cte_wp_at ((=) (ArchObjectCap (PageTableCap word None))) slot s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (PageTableCap word (Some (xc, args ! 0 && ~~ mask 20)))) c \<and> cap_asid c = None) slot s
 2. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; s \<turnstile> ArchObjectCap (PageTableCap word None); cte_wp_at ((=) (ArchObjectCap (PageTableCap word None))) slot s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s\<rbrakk> \<Longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pde_ref (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) = Some word \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs
 3. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; s \<turnstile> ArchObjectCap (PageTableCap word None); caps_of_state s slot = Some (ArchObjectCap (PageTableCap word None)); invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; caps_of_state s (aa, b) = Some (ArchObjectCap (PageDirectoryCap xa (Some xc)))\<rbrakk> \<Longrightarrow> is_arch_update (ArchObjectCap (PageTableCap word (Some (xc, args ! 0 && ~~ mask 20)))) (ArchObjectCap (PageTableCap word None))
 2. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; s \<turnstile> ArchObjectCap (PageTableCap word None); cte_wp_at ((=) (ArchObjectCap (PageTableCap word None))) slot s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s\<rbrakk> \<Longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pde_ref (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) = Some word \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs
 3. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; s \<turnstile> ArchObjectCap (PageTableCap word None); invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; caps_of_state s (aa, b) = Some (ArchObjectCap (PageDirectoryCap xa (Some xc))); s \<turnstile> ArchObjectCap (PageTableCap word None)\<rbrakk> \<Longrightarrow> is_arch_update (ArchObjectCap (PageTableCap word (Some (xc, args ! 0 && ~~ mask 20)))) (ArchObjectCap (PageTableCap word None))
 2. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; s \<turnstile> ArchObjectCap (PageTableCap word None); cte_wp_at ((=) (ArchObjectCap (PageTableCap word None))) slot s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s\<rbrakk> \<Longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pde_ref (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) = Some word \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs
 3. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; caps_of_state s (aa, b) = Some (ArchObjectCap (PageDirectoryCap xa (Some xc))); s \<turnstile> ArchObjectCap (PageTableCap word None)\<rbrakk> \<Longrightarrow> is_arch_update (ArchObjectCap (PageTableCap word (Some (xc, args ! 0 && ~~ mask 20)))) (ArchObjectCap (PageTableCap word None))
 2. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; s \<turnstile> ArchObjectCap (PageTableCap word None); cte_wp_at ((=) (ArchObjectCap (PageTableCap word None))) slot s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s\<rbrakk> \<Longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pde_ref (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) = Some word \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs
 3. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; caps_of_state s (aa, b) = Some (ArchObjectCap (PageDirectoryCap xa (Some xc))); s \<turnstile> ArchObjectCap (PageTableCap word None)\<rbrakk> \<Longrightarrow> is_arch_cap (ArchObjectCap (PageTableCap word (Some (xc, args ! 0 && ~~ mask 20))))
 2. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; s \<turnstile> ArchObjectCap (PageTableCap word None); cte_wp_at ((=) (ArchObjectCap (PageTableCap word None))) slot s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s\<rbrakk> \<Longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pde_ref (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) = Some word \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs
 3. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s
 4. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; s \<turnstile> ArchObjectCap (PageTableCap word None); cte_wp_at ((=) (ArchObjectCap (PageTableCap word None))) slot s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s\<rbrakk> \<Longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pde_ref (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) = Some word \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs
 2. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s
 3. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; s \<turnstile> ArchObjectCap (PageTableCap word None); cte_wp_at ((=) (ArchObjectCap (PageTableCap word None))) slot s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s\<rbrakk> \<Longrightarrow> valid_vspace_objs s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> pde_ref (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) = Some word \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs
 2. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s
 3. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; s \<turnstile> ArchObjectCap (PageTableCap word None); cte_wp_at ((=) (ArchObjectCap (PageTableCap word None))) slot s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s\<rbrakk> \<Longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> pde_ref (PageTablePDE (addrFromPPtr word) (attribs_from_word (args ! Suc 0) \<inter> {ParityEnabled}) 0) = Some word \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs
 2. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s
 3. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; s \<turnstile> ArchObjectCap (PageTableCap word None); cte_wp_at ((=) (ArchObjectCap (PageTableCap word None))) slot s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s\<rbrakk> \<Longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs
 2. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s
 3. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; s \<turnstile> ArchObjectCap (PageTableCap word None); cte_wp_at ((=) (ArchObjectCap (PageTableCap word None))) slot s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; valid_table_caps s\<rbrakk> \<Longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs
 2. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s
 3. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; s \<turnstile> ArchObjectCap (PageTableCap word None); caps_of_state s slot = Some (ArchObjectCap (PageTableCap word None)); invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; caps_of_state s (aa, b) = Some (ArchObjectCap (PageDirectoryCap xa (Some xc))); valid_table_caps s\<rbrakk> \<Longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs
 2. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s
 3. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; s \<turnstile> ArchObjectCap (PageTableCap word None); caps_of_state s slot = Some (ArchObjectCap (PageTableCap word None)); invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; caps_of_state s (aa, b) = Some (ArchObjectCap (PageDirectoryCap xa (Some xc))); valid_table_caps s; s \<turnstile> ArchObjectCap (PageTableCap word None)\<rbrakk> \<Longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs
 2. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s
 3. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; caps_of_state s slot = Some (ArchObjectCap (PageTableCap word None)); invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; caps_of_state s (aa, b) = Some (ArchObjectCap (PageDirectoryCap xa (Some xc))); valid_table_caps s; cap_aligned (ArchObjectCap (PageTableCap word None)); typ_at (AArch APageTable) word s\<rbrakk> \<Longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs
 2. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s
 3. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; caps_of_state s (aa, b) = Some (ArchObjectCap (PageDirectoryCap xa (Some xc))); valid_table_caps s; cap_aligned (ArchObjectCap (PageTableCap word None)); typ_at (AArch APageTable) word s; \<exists>pt. ako_at (PageTable pt) word s \<and> valid_vspace_obj (PageTable pt) s\<rbrakk> \<Longrightarrow> pspace_aligned s \<and> valid_vspace_objs s \<and> (\<exists>ao. ako_at ao word s \<and> valid_vspace_obj ao s) \<and> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs
 2. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s
 3. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>word s xa xc aa b ys. \<lbrakk>arch_cap = PageTableCap word None; invs s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; caps_of_state s (aa, b) = Some (ArchObjectCap (PageDirectoryCap xa (Some xc))); valid_table_caps s; cap_aligned (ArchObjectCap (PageTableCap word None)); typ_at (AArch APageTable) word s; \<exists>pt. ako_at (PageTable pt) word s \<and> valid_vspace_obj (PageTable pt) s\<rbrakk> \<Longrightarrow> VSRef (args ! 0 >> 20) (Some APageDirectory) \<notin> kernel_vsrefs
 2. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s
 3. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>word s xa xc aa b ys pt. \<lbrakk>arch_cap = PageTableCap word None; invs s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; \<not> kernel_base \<le> args ! 0; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; caps_of_state s (aa, b) = Some (ArchObjectCap (PageDirectoryCap xa (Some xc))); valid_table_caps s; cap_aligned (ArchObjectCap (PageTableCap word None)); typ_at (AArch APageTable) word s; ako_at (PageTable pt) word s; \<forall>x. valid_pte (pt x) s; kernel_base >> 20 \<le> args ! 0 >> 20\<rbrakk> \<Longrightarrow> False
 2. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s
 3. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>word s xa xc aa b ys pt. \<lbrakk>arch_cap = PageTableCap word None; invs s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; caps_of_state s (aa, b) = Some (ArchObjectCap (PageDirectoryCap xa (Some xc))); valid_table_caps s; cap_aligned (ArchObjectCap (PageTableCap word None)); typ_at (AArch APageTable) word s; ako_at (PageTable pt) word s; \<forall>x. valid_pte (pt x) s; kernel_base >> 20 \<le> args ! 0 >> 20; args ! 0 \<le> kernel_base - 1\<rbrakk> \<Longrightarrow> False
 2. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s
 3. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>word s xa xc aa b ys pt. \<lbrakk>arch_cap = PageTableCap word None; invs s; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; caps_of_state s (aa, b) = Some (ArchObjectCap (PageDirectoryCap xa (Some xc))); valid_table_caps s; cap_aligned (ArchObjectCap (PageTableCap word None)); typ_at (AArch APageTable) word s; ako_at (PageTable pt) word s; \<forall>x. valid_pte (pt x) s; args ! 0 >> 20 \<le> kernel_base - 1 >> 20; kernel_base >> 20 \<le> kernel_base - 1 >> 20\<rbrakk> \<Longrightarrow> False
 2. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s
 3. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> valid_arch_inv (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap word option)) slot)) s
 2. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>word option s. \<lbrakk>arch_cap = PageTableCap word option; invs s; s \<turnstile> ArchObjectCap (PageTableCap word option); cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s\<rbrakk> \<Longrightarrow> invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap word option)) s \<longrightarrow> is_pt_cap (ArchObjectCap (PageTableCap word option))
 2. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap arch_cap) and cte_wp_at ((=) (ArchObjectCap arch_cap)) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> arch_decode_invocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>x51 x52. arch_cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageDirectoryCap x51 x52)) and cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x51 x52))) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> if isPDFlushLabel (invocation_type label) then if 1 < length args then let start = args ! 0; end = args ! 1 in doE whenE (end \<le> start) $ throwError $ InvalidArgument 1;
whenE (kernel_base \<le> start \<or> kernel_base < end) $ throwError IllegalOperation;
(pd, asid) <- case PageDirectoryCap x51 x52 of PageDirectoryCap pd None \<Rightarrow> throwError $ InvalidCapability 0 | PageDirectoryCap pd (Some asid) \<Rightarrow> returnOk (pd, asid) | _ \<Rightarrow> throwError $ InvalidCapability 0;
pd' <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (pd' \<noteq> pd) $ throwError $ InvalidCapability 0;
(liftE $ resolve_vaddr pd start) >>=E case_option (returnOk $ InvokePageDirectory PageDirectoryNothing) (\<lambda>(frame_size, frame_base). let base_start = page_base start frame_size; base_end = page_base (end - 1) frame_size; offset = start && mask (pageBitsForSize frame_size); pstart = frame_base + offset in doE whenE (base_start \<noteq> base_end) $ throwError $ RangeError start (base_start + mask (pageBitsForSize frame_size));
returnOk $ InvokePageDirectory $ PageDirectoryFlush (label_to_flush_type (invocation_type label)) start (end - 1) pstart pd asid
odE)
odE else throwError TruncatedMessage else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>x51 x52. \<lbrakk>arch_cap = PageDirectoryCap x51 x52; isPDFlushLabel (invocation_type label)\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageDirectoryCap x51 x52)) and cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x51 x52))) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> if isPDFlushLabel (invocation_type label) then if 1 < length args then let start = args ! 0; end = args ! 1 in doE whenE (end \<le> start) $ throwError $ InvalidArgument 1;
whenE (kernel_base \<le> start \<or> kernel_base < end) $ throwError IllegalOperation;
(pd, asid) <- case PageDirectoryCap x51 x52 of PageDirectoryCap pd None \<Rightarrow> throwError $ InvalidCapability 0 | PageDirectoryCap pd (Some asid) \<Rightarrow> returnOk (pd, asid) | _ \<Rightarrow> throwError $ InvalidCapability 0;
pd' <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (pd' \<noteq> pd) $ throwError $ InvalidCapability 0;
(liftE $ resolve_vaddr pd start) >>=E case_option (returnOk $ InvokePageDirectory PageDirectoryNothing) (\<lambda>(frame_size, frame_base). let base_start = page_base start frame_size; base_end = page_base (end - 1) frame_size; offset = start && mask (pageBitsForSize frame_size); pstart = frame_base + offset in doE whenE (base_start \<noteq> base_end) $ throwError $ RangeError start (base_start + mask (pageBitsForSize frame_size));
returnOk $ InvokePageDirectory $ PageDirectoryFlush (label_to_flush_type (invocation_type label)) start (end - 1) pstart pd asid
odE)
odE else throwError TruncatedMessage else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, -
 2. \<And>x51 x52. \<lbrakk>arch_cap = PageDirectoryCap x51 x52; \<not> isPDFlushLabel (invocation_type label)\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageDirectoryCap x51 x52)) and cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x51 x52))) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> if isPDFlushLabel (invocation_type label) then if 1 < length args then let start = args ! 0; end = args ! 1 in doE whenE (end \<le> start) $ throwError $ InvalidArgument 1;
whenE (kernel_base \<le> start \<or> kernel_base < end) $ throwError IllegalOperation;
(pd, asid) <- case PageDirectoryCap x51 x52 of PageDirectoryCap pd None \<Rightarrow> throwError $ InvalidCapability 0 | PageDirectoryCap pd (Some asid) \<Rightarrow> returnOk (pd, asid) | _ \<Rightarrow> throwError $ InvalidCapability 0;
pd' <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (pd' \<noteq> pd) $ throwError $ InvalidCapability 0;
(liftE $ resolve_vaddr pd start) >>=E case_option (returnOk $ InvokePageDirectory PageDirectoryNothing) (\<lambda>(frame_size, frame_base). let base_start = page_base start frame_size; base_end = page_base (end - 1) frame_size; offset = start && mask (pageBitsForSize frame_size); pstart = frame_base + offset in doE whenE (base_start \<noteq> base_end) $ throwError $ RangeError start (base_start + mask (pageBitsForSize frame_size));
returnOk $ InvokePageDirectory $ PageDirectoryFlush (label_to_flush_type (invocation_type label)) start (end - 1) pstart pd asid
odE)
odE else throwError TruncatedMessage else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>x51 x52. \<lbrakk>arch_cap = PageDirectoryCap x51 x52; isPDFlushLabel (invocation_type label)\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageDirectoryCap x51 x52)) and cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x51 x52))) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> if Suc 0 < length args then let start = args ! 0; end = args ! 1 in doE whenE (end \<le> start) $ throwError $ InvalidArgument 1;
whenE (kernel_base \<le> start \<or> kernel_base < end) $ throwError IllegalOperation;
(pd, asid) <- case PageDirectoryCap x51 x52 of PageDirectoryCap pd None \<Rightarrow> throwError $ InvalidCapability 0 | PageDirectoryCap pd (Some asid) \<Rightarrow> returnOk (pd, asid) | _ \<Rightarrow> throwError $ InvalidCapability 0;
pd' <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (pd' \<noteq> pd) $ throwError $ InvalidCapability 0;
(liftE $ resolve_vaddr pd start) >>=E case_option (returnOk $ InvokePageDirectory PageDirectoryNothing) (\<lambda>(frame_size, frame_base). let base_start = page_base start frame_size; base_end = page_base (end - 1) frame_size; offset = start && mask (pageBitsForSize frame_size); pstart = frame_base + offset in doE whenE (base_start \<noteq> base_end) $ throwError $ RangeError start (base_start + mask (pageBitsForSize frame_size));
returnOk $ InvokePageDirectory $ PageDirectoryFlush (label_to_flush_type (invocation_type label)) start (end - 1) pstart pd asid
odE)
odE else throwError TruncatedMessage \<lbrace>valid_arch_inv\<rbrace>, -
 2. \<And>x51 x52. \<lbrakk>arch_cap = PageDirectoryCap x51 x52; \<not> isPDFlushLabel (invocation_type label)\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageDirectoryCap x51 x52)) and cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x51 x52))) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> if isPDFlushLabel (invocation_type label) then if 1 < length args then let start = args ! 0; end = args ! 1 in doE whenE (end \<le> start) $ throwError $ InvalidArgument 1;
whenE (kernel_base \<le> start \<or> kernel_base < end) $ throwError IllegalOperation;
(pd, asid) <- case PageDirectoryCap x51 x52 of PageDirectoryCap pd None \<Rightarrow> throwError $ InvalidCapability 0 | PageDirectoryCap pd (Some asid) \<Rightarrow> returnOk (pd, asid) | _ \<Rightarrow> throwError $ InvalidCapability 0;
pd' <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (pd' \<noteq> pd) $ throwError $ InvalidCapability 0;
(liftE $ resolve_vaddr pd start) >>=E case_option (returnOk $ InvokePageDirectory PageDirectoryNothing) (\<lambda>(frame_size, frame_base). let base_start = page_base start frame_size; base_end = page_base (end - 1) frame_size; offset = start && mask (pageBitsForSize frame_size); pstart = frame_base + offset in doE whenE (base_start \<noteq> base_end) $ throwError $ RangeError start (base_start + mask (pageBitsForSize frame_size));
returnOk $ InvokePageDirectory $ PageDirectoryFlush (label_to_flush_type (invocation_type label)) start (end - 1) pstart pd asid
odE)
odE else throwError TruncatedMessage else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>x51 x52. \<lbrakk>arch_cap = PageDirectoryCap x51 x52; isPDFlushLabel (invocation_type label)\<rbrakk> \<Longrightarrow> \<lbrace>?P'3659 x51 x52\<rbrace> if Suc 0 < length args then let start = args ! 0; end = args ! 1 in doE whenE (end \<le> start) $ throwError $ InvalidArgument 1;
whenE (kernel_base \<le> start \<or> kernel_base < end) $ throwError IllegalOperation;
(pd, asid) <- case PageDirectoryCap x51 x52 of PageDirectoryCap pd None \<Rightarrow> throwError $ InvalidCapability 0 | PageDirectoryCap pd (Some asid) \<Rightarrow> returnOk (pd, asid) | _ \<Rightarrow> throwError $ InvalidCapability 0;
pd' <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (pd' \<noteq> pd) $ throwError $ InvalidCapability 0;
(liftE $ resolve_vaddr pd start) >>=E case_option (returnOk $ InvokePageDirectory PageDirectoryNothing) (\<lambda>(frame_size, frame_base). let base_start = page_base start frame_size; base_end = page_base (end - 1) frame_size; offset = start && mask (pageBitsForSize frame_size); pstart = frame_base + offset in doE whenE (base_start \<noteq> base_end) $ throwError $ RangeError start (base_start + mask (pageBitsForSize frame_size));
returnOk $ InvokePageDirectory $ PageDirectoryFlush (label_to_flush_type (invocation_type label)) start (end - 1) pstart pd asid
odE)
odE else throwError TruncatedMessage \<lbrace>valid_arch_inv\<rbrace>, -
 2. \<And>x51 x52 s. \<lbrakk>arch_cap = PageDirectoryCap x51 x52; isPDFlushLabel (invocation_type label); (invs and valid_cap (ArchObjectCap (PageDirectoryCap x51 x52)) and cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x51 x52))) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)) s\<rbrakk> \<Longrightarrow> ?P'3659 x51 x52 s
 3. \<And>x51 x52. \<lbrakk>arch_cap = PageDirectoryCap x51 x52; \<not> isPDFlushLabel (invocation_type label)\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageDirectoryCap x51 x52)) and cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x51 x52))) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> if isPDFlushLabel (invocation_type label) then if 1 < length args then let start = args ! 0; end = args ! 1 in doE whenE (end \<le> start) $ throwError $ InvalidArgument 1;
whenE (kernel_base \<le> start \<or> kernel_base < end) $ throwError IllegalOperation;
(pd, asid) <- case PageDirectoryCap x51 x52 of PageDirectoryCap pd None \<Rightarrow> throwError $ InvalidCapability 0 | PageDirectoryCap pd (Some asid) \<Rightarrow> returnOk (pd, asid) | _ \<Rightarrow> throwError $ InvalidCapability 0;
pd' <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (pd' \<noteq> pd) $ throwError $ InvalidCapability 0;
(liftE $ resolve_vaddr pd start) >>=E case_option (returnOk $ InvokePageDirectory PageDirectoryNothing) (\<lambda>(frame_size, frame_base). let base_start = page_base start frame_size; base_end = page_base (end - 1) frame_size; offset = start && mask (pageBitsForSize frame_size); pstart = frame_base + offset in doE whenE (base_start \<noteq> base_end) $ throwError $ RangeError start (base_start + mask (pageBitsForSize frame_size));
returnOk $ InvokePageDirectory $ PageDirectoryFlush (label_to_flush_type (invocation_type label)) start (end - 1) pstart pd asid
odE)
odE else throwError TruncatedMessage else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (7 subgoals):
 1. \<And>x51 x52 x1 x2. \<lbrakk>arch_cap = PageDirectoryCap x51 x52; isPDFlushLabel (invocation_type label); Suc 0 < length args\<rbrakk> \<Longrightarrow> \<lbrace>?P'3892 x51 x52 () () (x1, x2) x1 x2\<rbrace> find_pd_for_asid x2 \<lbrace>\<lambda>pd' s. pd' = x1 \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (lookup_pd_slot x1 (args ! 0) && ~~ mask pd_bits) s \<longrightarrow> (\<forall>x. (\<exists>xa xb. (case pd (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x1 (args ! 0) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x1 (args ! 0) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x1 (args ! 0) && mask pd_bits >> 2))) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && ~~ mask pt_bits) s \<longrightarrow> ((\<exists>xa xb xc. (case pt (UCAST(32 \<rightarrow> 8) (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && ~~ mask 6 && mask pt_bits >> 2)) of LargePagePTE xa xaa xb \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && ~~ mask 6 && mask pt_bits >> 2)) | _ \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && mask pt_bits >> 2))) = LargePagePTE xa xb xc) \<longrightarrow> page_base (args ! 0) ARMLargePage = page_base (args ! Suc 0 - 1) ARMLargePage \<longrightarrow> vspace_at_asid x2 x1 s \<and> x2 \<le> mask local.asid_bits \<and> x2 \<noteq> 0) \<and> ((\<exists>xa xb xc. (case pt (UCAST(32 \<rightarrow> 8) (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && ~~ mask 6 && mask pt_bits >> 2)) of LargePagePTE xa xaa xb \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && ~~ mask 6 && mask pt_bits >> 2)) | _ \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && mask pt_bits >> 2))) = SmallPagePTE xa xb xc) \<longrightarrow> page_base (args ! 0) ARMSmallPage = page_base (args ! Suc 0 - 1) ARMSmallPage \<longrightarrow> vspace_at_asid x2 x1 s \<and> x2 \<le> mask local.asid_bits \<and> x2 \<noteq> 0))) \<and> ((\<exists>x xa xb xc. (case pd (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x1 (args ! 0) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x1 (args ! 0) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x1 (args ! 0) && mask pd_bits >> 2))) = SectionPDE x xa xb xc) \<longrightarrow> page_base (args ! 0) ARMSection = page_base (args ! Suc 0 - 1) ARMSection \<longrightarrow> vspace_at_asid x2 x1 s \<and> x2 \<le> mask local.asid_bits \<and> x2 \<noteq> 0) \<and> ((\<exists>x xa xb. (case pd (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x1 (args ! 0) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x1 (args ! 0) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x1 (args ! 0) && mask pd_bits >> 2))) = SuperSectionPDE x xa xb) \<longrightarrow> page_base (args ! 0) ARMSuperSection = page_base (args ! Suc 0 - 1) ARMSuperSection \<longrightarrow> vspace_at_asid x2 x1 s \<and> x2 \<le> mask local.asid_bits \<and> x2 \<noteq> 0))\<rbrace>, -
 2. \<And>x51 x52 y ya. \<lbrakk>arch_cap = PageDirectoryCap x51 x52; isPDFlushLabel (invocation_type label); Suc 0 < length args\<rbrakk> \<Longrightarrow> \<lbrace>?B3668 x51 x52 y ya\<rbrace> case x52 of None \<Rightarrow> throwError (InvalidCapability 0) | Some asid \<Rightarrow> returnOk (x51, asid) \<lbrace>\<lambda>x s. \<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> ?P'3892 x51 x52 y ya x xa xb s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x51 x52 y. \<lbrakk>arch_cap = PageDirectoryCap x51 x52; isPDFlushLabel (invocation_type label); Suc 0 < length args\<rbrakk> \<Longrightarrow> \<lbrace>?B3667 x51 x52 y\<rbrace> whenE (kernel_base \<le> args ! 0 \<or> kernel_base < args ! Suc 0) (throwError IllegalOperation) \<lbrace>?B3668 x51 x52 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x51 x52. \<lbrakk>arch_cap = PageDirectoryCap x51 x52; isPDFlushLabel (invocation_type label); Suc 0 < length args\<rbrakk> \<Longrightarrow> \<lbrace>?Qa3663 x51 x52\<rbrace> whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0))) \<lbrace>?B3667 x51 x52\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x51 x52. \<lbrakk>arch_cap = PageDirectoryCap x51 x52; isPDFlushLabel (invocation_type label); \<not> Suc 0 < length args\<rbrakk> \<Longrightarrow> \<lbrace>?R3663 x51 x52\<rbrace> throwError TruncatedMessage \<lbrace>valid_arch_inv\<rbrace>, -
 6. \<And>x51 x52 s. \<lbrakk>arch_cap = PageDirectoryCap x51 x52; isPDFlushLabel (invocation_type label); (invs and valid_cap (ArchObjectCap (PageDirectoryCap x51 x52)) and cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x51 x52))) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)) s\<rbrakk> \<Longrightarrow> (Suc 0 < length args \<longrightarrow> ?Qa3663 x51 x52 s) \<and> (\<not> Suc 0 < length args \<longrightarrow> ?R3663 x51 x52 s)
 7. \<And>x51 x52. \<lbrakk>arch_cap = PageDirectoryCap x51 x52; \<not> isPDFlushLabel (invocation_type label)\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageDirectoryCap x51 x52)) and cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x51 x52))) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> if isPDFlushLabel (invocation_type label) then if 1 < length args then let start = args ! 0; end = args ! 1 in doE whenE (end \<le> start) $ throwError $ InvalidArgument 1;
whenE (kernel_base \<le> start \<or> kernel_base < end) $ throwError IllegalOperation;
(pd, asid) <- case PageDirectoryCap x51 x52 of PageDirectoryCap pd None \<Rightarrow> throwError $ InvalidCapability 0 | PageDirectoryCap pd (Some asid) \<Rightarrow> returnOk (pd, asid) | _ \<Rightarrow> throwError $ InvalidCapability 0;
pd' <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (pd' \<noteq> pd) $ throwError $ InvalidCapability 0;
(liftE $ resolve_vaddr pd start) >>=E case_option (returnOk $ InvokePageDirectory PageDirectoryNothing) (\<lambda>(frame_size, frame_base). let base_start = page_base start frame_size; base_end = page_base (end - 1) frame_size; offset = start && mask (pageBitsForSize frame_size); pstart = frame_base + offset in doE whenE (base_start \<noteq> base_end) $ throwError $ RangeError start (base_start + mask (pageBitsForSize frame_size));
returnOk $ InvokePageDirectory $ PageDirectoryFlush (label_to_flush_type (invocation_type label)) start (end - 1) pstart pd asid
odE)
odE else throwError TruncatedMessage else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (8 subgoals):
 1. \<And>x51 x52 x1 x2. \<lbrakk>arch_cap = PageDirectoryCap x51 x52; isPDFlushLabel (invocation_type label); Suc 0 < length args\<rbrakk> \<Longrightarrow> \<lbrace>?P'3892 x51 x52 () () (x1, x2) x1 x2\<rbrace> find_pd_for_asid x2 \<lbrace>\<lambda>pd' s. vspace_at_asid x2 pd' s \<and> x2 \<le> mask local.asid_bits \<and> x2 \<noteq> 0\<rbrace>, -
 2. \<And>x51 x52 x1 x2 rv s. \<lbrakk>arch_cap = PageDirectoryCap x51 x52; isPDFlushLabel (invocation_type label); Suc 0 < length args; vspace_at_asid x2 rv s \<and> x2 \<le> mask local.asid_bits \<and> x2 \<noteq> 0\<rbrakk> \<Longrightarrow> rv = x1 \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (lookup_pd_slot x1 (args ! 0) && ~~ mask pd_bits) s \<longrightarrow> (\<forall>x. (\<exists>xa xb. (case pd (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x1 (args ! 0) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x1 (args ! 0) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x1 (args ! 0) && mask pd_bits >> 2))) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && ~~ mask pt_bits) s \<longrightarrow> ((\<exists>xa xb xc. (case pt (UCAST(32 \<rightarrow> 8) (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && ~~ mask 6 && mask pt_bits >> 2)) of LargePagePTE xa xaa xb \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && ~~ mask 6 && mask pt_bits >> 2)) | _ \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && mask pt_bits >> 2))) = LargePagePTE xa xb xc) \<longrightarrow> page_base (args ! 0) ARMLargePage = page_base (args ! Suc 0 - 1) ARMLargePage \<longrightarrow> vspace_at_asid x2 x1 s \<and> x2 \<le> mask local.asid_bits \<and> x2 \<noteq> 0) \<and> ((\<exists>xa xb xc. (case pt (UCAST(32 \<rightarrow> 8) (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && ~~ mask 6 && mask pt_bits >> 2)) of LargePagePTE xa xaa xb \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && ~~ mask 6 && mask pt_bits >> 2)) | _ \<Rightarrow> pt (UCAST(32 \<rightarrow> 8) (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && mask pt_bits >> 2))) = SmallPagePTE xa xb xc) \<longrightarrow> page_base (args ! 0) ARMSmallPage = page_base (args ! Suc 0 - 1) ARMSmallPage \<longrightarrow> vspace_at_asid x2 x1 s \<and> x2 \<le> mask local.asid_bits \<and> x2 \<noteq> 0))) \<and> ((\<exists>x xa xb xc. (case pd (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x1 (args ! 0) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x1 (args ! 0) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x1 (args ! 0) && mask pd_bits >> 2))) = SectionPDE x xa xb xc) \<longrightarrow> page_base (args ! 0) ARMSection = page_base (args ! Suc 0 - 1) ARMSection \<longrightarrow> vspace_at_asid x2 x1 s \<and> x2 \<le> mask local.asid_bits \<and> x2 \<noteq> 0) \<and> ((\<exists>x xa xb. (case pd (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x1 (args ! 0) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x1 (args ! 0) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x1 (args ! 0) && mask pd_bits >> 2))) = SuperSectionPDE x xa xb) \<longrightarrow> page_base (args ! 0) ARMSuperSection = page_base (args ! Suc 0 - 1) ARMSuperSection \<longrightarrow> vspace_at_asid x2 x1 s \<and> x2 \<le> mask local.asid_bits \<and> x2 \<noteq> 0))
 3. \<And>x51 x52 y ya. \<lbrakk>arch_cap = PageDirectoryCap x51 x52; isPDFlushLabel (invocation_type label); Suc 0 < length args\<rbrakk> \<Longrightarrow> \<lbrace>?B3668 x51 x52 y ya\<rbrace> case x52 of None \<Rightarrow> throwError (InvalidCapability 0) | Some asid \<Rightarrow> returnOk (x51, asid) \<lbrace>\<lambda>x s. \<forall>xa xb. x = (xa, xb) \<longrightarrow> True \<and> ?P'3892 x51 x52 y ya x xa xb s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x51 x52 y. \<lbrakk>arch_cap = PageDirectoryCap x51 x52; isPDFlushLabel (invocation_type label); Suc 0 < length args\<rbrakk> \<Longrightarrow> \<lbrace>?B3667 x51 x52 y\<rbrace> whenE (kernel_base \<le> args ! 0 \<or> kernel_base < args ! Suc 0) (throwError IllegalOperation) \<lbrace>?B3668 x51 x52 y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x51 x52. \<lbrakk>arch_cap = PageDirectoryCap x51 x52; isPDFlushLabel (invocation_type label); Suc 0 < length args\<rbrakk> \<Longrightarrow> \<lbrace>?Qa3663 x51 x52\<rbrace> whenE (args ! Suc 0 \<le> args ! 0) (throwError (InvalidArgument (Suc 0))) \<lbrace>?B3667 x51 x52\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x51 x52. \<lbrakk>arch_cap = PageDirectoryCap x51 x52; isPDFlushLabel (invocation_type label); \<not> Suc 0 < length args\<rbrakk> \<Longrightarrow> \<lbrace>?R3663 x51 x52\<rbrace> throwError TruncatedMessage \<lbrace>valid_arch_inv\<rbrace>, -
 7. \<And>x51 x52 s. \<lbrakk>arch_cap = PageDirectoryCap x51 x52; isPDFlushLabel (invocation_type label); (invs and valid_cap (ArchObjectCap (PageDirectoryCap x51 x52)) and cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x51 x52))) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)) s\<rbrakk> \<Longrightarrow> (Suc 0 < length args \<longrightarrow> ?Qa3663 x51 x52 s) \<and> (\<not> Suc 0 < length args \<longrightarrow> ?R3663 x51 x52 s)
 8. \<And>x51 x52. \<lbrakk>arch_cap = PageDirectoryCap x51 x52; \<not> isPDFlushLabel (invocation_type label)\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageDirectoryCap x51 x52)) and cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x51 x52))) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> if isPDFlushLabel (invocation_type label) then if 1 < length args then let start = args ! 0; end = args ! 1 in doE whenE (end \<le> start) $ throwError $ InvalidArgument 1;
whenE (kernel_base \<le> start \<or> kernel_base < end) $ throwError IllegalOperation;
(pd, asid) <- case PageDirectoryCap x51 x52 of PageDirectoryCap pd None \<Rightarrow> throwError $ InvalidCapability 0 | PageDirectoryCap pd (Some asid) \<Rightarrow> returnOk (pd, asid) | _ \<Rightarrow> throwError $ InvalidCapability 0;
pd' <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (pd' \<noteq> pd) $ throwError $ InvalidCapability 0;
(liftE $ resolve_vaddr pd start) >>=E case_option (returnOk $ InvokePageDirectory PageDirectoryNothing) (\<lambda>(frame_size, frame_base). let base_start = page_base start frame_size; base_end = page_base (end - 1) frame_size; offset = start && mask (pageBitsForSize frame_size); pstart = frame_base + offset in doE whenE (base_start \<noteq> base_end) $ throwError $ RangeError start (base_start + mask (pageBitsForSize frame_size));
returnOk $ InvokePageDirectory $ PageDirectoryFlush (label_to_flush_type (invocation_type label)) start (end - 1) pstart pd asid
odE)
odE else throwError TruncatedMessage else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>x51 s x. \<lbrakk>arch_cap = PageDirectoryCap x51 (Some x); isPDFlushLabel (invocation_type label); invs s; s \<turnstile> ArchObjectCap (PageDirectoryCap x51 (Some x)); cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x51 (Some x)))) slot s; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s; Suc 0 < length args\<rbrakk> \<Longrightarrow> x \<le> mask local.asid_bits \<and> x \<noteq> 0
 2. \<And>x51 x52. \<lbrakk>arch_cap = PageDirectoryCap x51 x52; \<not> isPDFlushLabel (invocation_type label)\<rbrakk> \<Longrightarrow> \<lbrace>invs and valid_cap (ArchObjectCap (PageDirectoryCap x51 x52)) and cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x51 x52))) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrace> if isPDFlushLabel (invocation_type label) then if 1 < length args then let start = args ! 0; end = args ! 1 in doE whenE (end \<le> start) $ throwError $ InvalidArgument 1;
whenE (kernel_base \<le> start \<or> kernel_base < end) $ throwError IllegalOperation;
(pd, asid) <- case PageDirectoryCap x51 x52 of PageDirectoryCap pd None \<Rightarrow> throwError $ InvalidCapability 0 | PageDirectoryCap pd (Some asid) \<Rightarrow> returnOk (pd, asid) | _ \<Rightarrow> throwError $ InvalidCapability 0;
pd' <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (pd' \<noteq> pd) $ throwError $ InvalidCapability 0;
(liftE $ resolve_vaddr pd start) >>=E case_option (returnOk $ InvokePageDirectory PageDirectoryNothing) (\<lambda>(frame_size, frame_base). let base_start = page_base start frame_size; base_end = page_base (end - 1) frame_size; offset = start && mask (pageBitsForSize frame_size); pstart = frame_base + offset in doE whenE (base_start \<noteq> base_end) $ throwError $ RangeError start (base_start + mask (pageBitsForSize frame_size));
returnOk $ InvokePageDirectory $ PageDirectoryFlush (label_to_flush_type (invocation_type label)) start (end - 1) pstart pd asid
odE)
odE else throwError TruncatedMessage else throwError IllegalOperation \<lbrace>valid_arch_inv\<rbrace>, - proof (prove)
goal:
No subgoals!