theory ArchArch_AI

lemma create_mapping_entries_same_refs:
  "\<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s))
    and pspace_aligned and valid_objs and valid_kernel_mappings and \<exists>\<rhd> pd and
    (\<lambda>s. \<exists>pd_cap pd_cptr. cte_wp_at ((=) pd_cap) pd_cptr s
          \<and> pd_cap = cap.ArchObjectCap (arch_cap.PageDirectoryCap pd (Some asid))) and
    page_directory_at pd and K (vaddr < kernel_base \<and> (cap = (cap.ArchObjectCap (arch_cap.PageCap dev p rights' pgsz (Some (asid, vaddr))))))\<rbrace>
   create_mapping_entries (addrFromPPtr p) vaddr pgsz rights attribs pd
   \<lbrace>\<lambda>rv s. same_refs rv cap s\<rbrace>,-" apply (rule hoare_gen_asmE) apply (cases pgsz, simp_all add: lookup_pt_slot_def
                                   largePagePTE_offsets_def superSectionPDE_offsets_def) apply (wp get_pde_wp | wpc)+ apply (clarsimp simp: lookup_pd_slot_def) apply (frule (1) pd_aligned) apply (simp add:pd_shifting vaddr_segment_nonsense2 pt_bits_def) apply (frule (2) valid_vspace_objsD[rotated], simp) apply (drule bspec, simp, erule kernel_base_kernel_mapping_slots) apply (simp, drule (1) pt_aligned) apply (clarsimp simp: same_refs_def vs_cap_ref_def split: option.splits) apply (simp add: vaddr_segment_nonsense4 shiftl_shiftr_id
                      less_trans[OF and_mask_less'[where n=8, unfolded mask_def, simplified]]
                      word_bits_def
                      vaddr_segment_nonsense3) apply (rule conjI, simp add: mask_def) apply (clarsimp simp: cte_wp_at_caps_of_state
                           mask_cap_def cap_rights_update_def) apply (frule (1) vs_lookup_and_unique_refs) apply (simp_all add: table_cap_ref_def obj_refs_def)[4] apply (frule_tac p=pd and p'="ptrFromPAddr x" in vs_lookup_step) apply (clarsimp simp: vs_lookup1_def) apply (rule exI, erule conjI) apply (rule exI[where x="VSRef (vaddr >> 20) (Some APageDirectory)"]) apply (rule conjI, rule refl) apply (simp add: vs_refs_def) apply (rule_tac x="(ucast (vaddr >> 20), ptrFromPAddr x)" in image_eqI) apply (simp add: ucast_ucast_len[OF shiftr_less_t2n'] graph_of_def) apply (clarsimp simp:graph_of_def) apply (frule kernel_base_kernel_mapping_slots, simp add: pde_ref_def) apply simp apply (drule (1) ref_is_unique) apply (rule not_kernel_slot_not_global_pt[simplified second_level_tables_def, rotated]) apply (erule kernel_base_kernel_mapping_slots) apply (simp add: obj_at_def) apply (simp_all add: pde_ref_def valid_arch_state_def valid_objs_caps)[8] apply (wp get_pde_wp | wpc)+ apply (clarsimp simp: lookup_pd_slot_def) apply (frule (1) pd_aligned) apply (simp add:pd_shifting vaddr_segment_nonsense2) apply (frule (2) valid_vspace_objsD[rotated], simp) apply (drule bspec, simp, erule kernel_base_kernel_mapping_slots) apply (simp, drule (1) pt_aligned) apply (clarsimp simp: same_refs_def vs_cap_ref_def upto_enum_step_def upto_enum_word upt_conv_Cons) apply (simp add: vaddr_segment_nonsense4 shiftl_shiftr_id
                     less_trans[OF and_mask_less'[where n=8, unfolded mask_def, simplified]]
                     word_bits_def
                     vaddr_segment_nonsense3) apply (rule conjI, simp add: mask_def) apply (clarsimp simp: cte_wp_at_caps_of_state
                          mask_cap_def cap_rights_update_def) apply (frule (1) vs_lookup_and_unique_refs) apply (simp_all add: table_cap_ref_def obj_refs_def)[4] apply (frule_tac p=pd and p'="ptrFromPAddr x" in vs_lookup_step) apply (clarsimp simp: vs_lookup1_def) apply (rule exI, erule conjI) apply (rule exI[where x="VSRef (vaddr >> 20) (Some APageDirectory)"]) apply (rule conjI, rule refl) apply (simp add: vs_refs_def) apply (rule_tac x="(ucast (vaddr >> 20), ptrFromPAddr x)" in image_eqI) apply (simp add: ucast_ucast_len[OF shiftr_less_t2n'] graph_of_def) apply (clarsimp simp: graph_of_def) apply (frule kernel_base_kernel_mapping_slots, simp add: pde_ref_def) apply simp apply (drule (1) ref_is_unique) apply (rule not_kernel_slot_not_global_pt[simplified second_level_tables_def, rotated]) apply (erule kernel_base_kernel_mapping_slots) apply (simp add: obj_at_def) apply (simp_all add: pde_ref_def valid_arch_state_def valid_objs_caps)[8] apply (wp get_pde_wp returnOKE_R_wp | wpc)+ apply (clarsimp simp: lookup_pd_slot_def) apply (frule (1) pd_aligned) apply (clarsimp simp: same_refs_def vs_cap_ref_def pde_ref_pages_def) apply (simp add: vaddr_segment_nonsense vaddr_segment_nonsense2) apply (clarsimp simp: cte_wp_at_caps_of_state
                         mask_cap_def cap_rights_update_def) apply (frule (1) vs_lookup_and_unique_refs) apply (simp_all add: table_cap_ref_def obj_refs_def)[4] apply (drule (1) ref_is_unique) apply (clarsimp simp: valid_arch_state_def obj_at_def dest!: valid_global_ptsD2) apply (simp_all add: valid_arch_state_def valid_objs_caps)[6] apply (wp returnOKE_R_wp | wpc)+ apply (clarsimp simp: lookup_pd_slot_def) apply (frule (1) pd_aligned) apply (clarsimp simp: same_refs_def vs_cap_ref_def pde_ref_pages_def upto_enum_step_def upto_enum_word upt_conv_Cons) apply (simp add: vaddr_segment_nonsense vaddr_segment_nonsense2) apply (clarsimp simp: cte_wp_at_caps_of_state
                        mask_cap_def cap_rights_update_def) apply (frule (1) vs_lookup_and_unique_refs) apply (simp_all add: table_cap_ref_def obj_refs_def)[4] apply (drule (1) ref_is_unique) apply (clarsimp dest!: valid_global_ptsD2 simp: obj_at_def a_type_def valid_arch_state_def) apply (simp_all add: valid_arch_state_def valid_objs_caps) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>pd_cap pd_cptr. cte_wp_at ((=) pd_cap) pd_cptr s \<and> pd_cap = ArchObjectCap (PageDirectoryCap pd (Some asid))) and typ_at (AArch APageDirectory) pd and K (vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' pgsz (Some (asid, vaddr))))\<rbrace> create_mapping_entries (addrFromPPtr p) vaddr pgsz rights attribs pd \<lbrace>\<lambda>rv. same_refs rv cap\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' pgsz (Some (asid, vaddr))) \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>pd_cap pd_cptr. cte_wp_at ((=) pd_cap) pd_cptr s \<and> pd_cap = ArchObjectCap (PageDirectoryCap pd (Some asid))) and typ_at (AArch APageDirectory) pd\<rbrace> create_mapping_entries (addrFromPPtr p) vaddr pgsz rights attribs pd \<lbrace>\<lambda>rv. same_refs rv cap\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); pgsz = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> doE pa <- lookup_error_on_failure False (liftE (get_pde (lookup_pd_slot pd vaddr)) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20)));
returnOk (Inl (SmallPagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, [pa]))
odE \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))))\<rbrace>, -
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); pgsz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> doE pa <- lookup_error_on_failure False (liftE (get_pde (lookup_pd_slot pd vaddr)) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20)));
returnOk (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))
odE \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))))\<rbrace>, -
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 4. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); pgsz = ARMSmallPage; (valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd) s\<rbrakk> \<Longrightarrow> True \<and> True \<and> (\<forall>pda. ako_at (PageDirectory pda) (lookup_pd_slot pd vaddr && ~~ mask pd_bits) s \<longrightarrow> (pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vaddr && mask pd_bits >> 2)) = InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vaddr && mask pd_bits >> 2)) = PageTablePDE x xa xb \<longrightarrow> same_refs (Inl (SmallPagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, [ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2)])) (ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr)))) s) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vaddr && mask pd_bits >> 2)) = SectionPDE x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vaddr && mask pd_bits >> 2)) = SuperSectionPDE x xa xb \<longrightarrow> True))
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); pgsz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> doE pa <- lookup_error_on_failure False (liftE (get_pde (lookup_pd_slot pd vaddr)) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20)));
returnOk (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))
odE \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))))\<rbrace>, -
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 4. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s pda ref a b x xa xb. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s; ako_at (PageDirectory pda) (pd + (vaddr >> 20 << 2) && ~~ mask pd_bits) s; pda (UCAST(32 \<rightarrow> 12) (pd + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb\<rbrakk> \<Longrightarrow> same_refs (Inl (SmallPagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, [ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2)])) (ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr)))) s
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); pgsz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> doE pa <- lookup_error_on_failure False (liftE (get_pde (lookup_pd_slot pd vaddr)) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20)));
returnOk (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))
odE \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))))\<rbrace>, -
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 4. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s pda ref a b x xa xb. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s; ako_at (PageDirectory pda) (pd + (vaddr >> 20 << 2) && ~~ mask pd_bits) s; pda (UCAST(32 \<rightarrow> 12) (pd + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb; is_aligned pd 14\<rbrakk> \<Longrightarrow> same_refs (Inl (SmallPagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, [ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2)])) (ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr)))) s
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); pgsz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> doE pa <- lookup_error_on_failure False (liftE (get_pde (lookup_pd_slot pd vaddr)) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20)));
returnOk (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))
odE \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))))\<rbrace>, -
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 4. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s pda ref a b x xa xb. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s; ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14\<rbrakk> \<Longrightarrow> same_refs (Inl (SmallPagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, [ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2)])) (ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr)))) s
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); pgsz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> doE pa <- lookup_error_on_failure False (liftE (get_pde (lookup_pd_slot pd vaddr)) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20)));
returnOk (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))
odE \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))))\<rbrace>, -
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 4. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s pda ref a b x xa xb. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s; ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; \<forall>x\<in>- kernel_mapping_slots. valid_pde (pda x) s\<rbrakk> \<Longrightarrow> same_refs (Inl (SmallPagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, [ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2)])) (ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr)))) s
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); pgsz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> doE pa <- lookup_error_on_failure False (liftE (get_pde (lookup_pd_slot pd vaddr)) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20)));
returnOk (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))
odE \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))))\<rbrace>, -
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 4. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s pda ref a b x xa xb. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s; ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s\<rbrakk> \<Longrightarrow> same_refs (Inl (SmallPagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, [ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2)])) (ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr)))) s
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); pgsz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> doE pa <- lookup_error_on_failure False (liftE (get_pde (lookup_pd_slot pd vaddr)) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20)));
returnOk (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))
odE \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))))\<rbrace>, -
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 4. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s pda ref a b x xa xb. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s; ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10\<rbrakk> \<Longrightarrow> same_refs (Inl (SmallPagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, [ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2)])) (ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr)))) s
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); pgsz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> doE pa <- lookup_error_on_failure False (liftE (get_pde (lookup_pd_slot pd vaddr)) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20)));
returnOk (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))
odE \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))))\<rbrace>, -
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 4. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s; ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits)) s\<rbrakk> \<Longrightarrow> (vaddr >> 12) && mask 8 = ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2 \<and> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); pgsz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> doE pa <- lookup_error_on_failure False (liftE (get_pde (lookup_pd_slot pd vaddr)) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20)));
returnOk (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))
odE \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))))\<rbrace>, -
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 4. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s; ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> (vaddr >> 12) && mask 8 = (vaddr >> 12) && 0xFF \<and> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); pgsz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> doE pa <- lookup_error_on_failure False (liftE (get_pde (lookup_pd_slot pd vaddr)) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20)));
returnOk (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))
odE \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))))\<rbrace>, -
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 4. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s; ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); pgsz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> doE pa <- lookup_error_on_failure False (liftE (get_pde (lookup_pd_slot pd vaddr)) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20)));
returnOk (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))
odE \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))))\<rbrace>, -
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 4. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); pgsz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> doE pa <- lookup_error_on_failure False (liftE (get_pde (lookup_pd_slot pd vaddr)) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20)));
returnOk (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))
odE \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))))\<rbrace>, -
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 4. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (8 subgoals):
 1. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> table_cap_ref (ArchObjectCap (PageDirectoryCap pd (Some asid))) = Some (?ref'108 s pda ref a b x xa xb refa)
 2. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> pd \<in> obj_refs (ArchObjectCap (PageDirectoryCap pd (Some asid)))
 3. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_vs_lookup s
 4. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> unique_table_refs (caps_of_state s)
 5. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s; ref = ?ref'108 s pda ref a b x xa xb refa\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 6. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); pgsz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> doE pa <- lookup_error_on_failure False (liftE (get_pde (lookup_pd_slot pd vaddr)) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20)));
returnOk (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))
odE \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))))\<rbrace>, -
 7. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 8. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); pgsz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> doE pa <- lookup_error_on_failure False (liftE (get_pde (lookup_pd_slot pd vaddr)) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20)));
returnOk (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))
odE \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))))\<rbrace>, -
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 4. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> ((ref, pd), ?ref'118 s pda ref a b x xa xb refa, ptrFromPAddr x) \<in> vs_lookup1 s
 2. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; (?ref'118 s pda ref a b x xa xb refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); pgsz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> doE pa <- lookup_error_on_failure False (liftE (get_pde (lookup_pd_slot pd vaddr)) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20)));
returnOk (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))
odE \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))))\<rbrace>, -
 4. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 5. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>s pda a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> \<exists>ko. ko_at ko pd s \<and> (\<exists>r. ?ref'118 s pda [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] a b x xa xb refa = [r, VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<and> (r, ptrFromPAddr x) \<in> vs_refs ko)
 2. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; (?ref'118 s pda ref a b x xa xb refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); pgsz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> doE pa <- lookup_error_on_failure False (liftE (get_pde (lookup_pd_slot pd vaddr)) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20)));
returnOk (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))
odE \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))))\<rbrace>, -
 4. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 5. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>s pda a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> \<exists>r. ?ref'118 s pda [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] a b x xa xb refa = [r, VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<and> (r, ptrFromPAddr x) \<in> vs_refs (ArchObj (PageDirectory pda))
 2. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; (?ref'118 s pda ref a b x xa xb refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); pgsz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> doE pa <- lookup_error_on_failure False (liftE (get_pde (lookup_pd_slot pd vaddr)) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20)));
returnOk (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))
odE \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))))\<rbrace>, -
 4. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 5. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>s pda a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> ?ref'118 s pda [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] a b x xa xb refa = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<and> (VSRef (vaddr >> 20) (Some APageDirectory), ptrFromPAddr x) \<in> vs_refs (ArchObj (PageDirectory pda))
 2. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; (?ref'118 s pda ref a b x xa xb refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); pgsz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> doE pa <- lookup_error_on_failure False (liftE (get_pde (lookup_pd_slot pd vaddr)) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20)));
returnOk (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))
odE \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))))\<rbrace>, -
 4. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 5. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>s pda a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> (VSRef (vaddr >> 20) (Some APageDirectory), ptrFromPAddr x) \<in> vs_refs (ArchObj (PageDirectory pda))
 2. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ((VSRef (vaddr >> 20) (Some APageDirectory) # ref) \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); pgsz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> doE pa <- lookup_error_on_failure False (liftE (get_pde (lookup_pd_slot pd vaddr)) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20)));
returnOk (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))
odE \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))))\<rbrace>, -
 4. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 5. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>s pda a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> (VSRef (vaddr >> 20) (Some APageDirectory), ptrFromPAddr x) \<in> (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pda x))
 2. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ((VSRef (vaddr >> 20) (Some APageDirectory) # ref) \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); pgsz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> doE pa <- lookup_error_on_failure False (liftE (get_pde (lookup_pd_slot pd vaddr)) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20)));
returnOk (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))
odE \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))))\<rbrace>, -
 4. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 5. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>s pda a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> (VSRef (vaddr >> 20) (Some APageDirectory), ptrFromPAddr x) = (case (UCAST(32 \<rightarrow> 12) (vaddr >> 20), ptrFromPAddr x) of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x))
 2. \<And>s pda a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> (UCAST(32 \<rightarrow> 12) (vaddr >> 20), ptrFromPAddr x) \<in> graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pda x))
 3. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ((VSRef (vaddr >> 20) (Some APageDirectory) # ref) \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 4. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); pgsz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> doE pa <- lookup_error_on_failure False (liftE (get_pde (lookup_pd_slot pd vaddr)) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20)));
returnOk (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))
odE \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))))\<rbrace>, -
 5. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 6. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>s pda a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> (UCAST(32 \<rightarrow> 12) (vaddr >> 20), ptrFromPAddr x) \<in> graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pda x))
 2. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ((VSRef (vaddr >> 20) (Some APageDirectory) # ref) \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); pgsz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> doE pa <- lookup_error_on_failure False (liftE (get_pde (lookup_pd_slot pd vaddr)) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20)));
returnOk (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))
odE \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))))\<rbrace>, -
 4. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 5. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>s pda a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots \<and> (UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots \<longrightarrow> pde_ref (PageTablePDE x xa xb) = Some (ptrFromPAddr x))
 2. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ((VSRef (vaddr >> 20) (Some APageDirectory) # ref) \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); pgsz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> doE pa <- lookup_error_on_failure False (liftE (get_pde (lookup_pd_slot pd vaddr)) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20)));
returnOk (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))
odE \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))))\<rbrace>, -
 4. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 5. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ((VSRef (vaddr >> 20) (Some APageDirectory) # ref) \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); pgsz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> doE pa <- lookup_error_on_failure False (liftE (get_pde (lookup_pd_slot pd vaddr)) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20)));
returnOk (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))
odE \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))))\<rbrace>, -
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 4. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); pgsz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> doE pa <- lookup_error_on_failure False (liftE (get_pde (lookup_pd_slot pd vaddr)) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20)));
returnOk (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))
odE \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))))\<rbrace>, -
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 4. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (10 subgoals):
 1. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> ptrFromPAddr x \<notin> set (arm_global_pts (arch_state s))
 2. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_vs_lookup s
 3. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> unique_table_refs (caps_of_state s)
 4. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 5. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_asid_table (asid_table s) s
 6. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_caps (caps_of_state s) s
 7. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s; refa = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 8. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); pgsz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> doE pa <- lookup_error_on_failure False (liftE (get_pde (lookup_pd_slot pd vaddr)) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20)));
returnOk (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))
odE \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))))\<rbrace>, -
 9. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 10. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (13 subgoals):
 1. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> ?x152 s pda ref a b x xa xb refa \<notin> kernel_mapping_slots
 2. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> kheap s (?p'152 s pda ref a b x xa xb refa) = Some (ArchObj (PageDirectory (?pd152 s pda ref a b x xa xb refa)))
 3. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_kernel_mappings s
 4. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> pde_ref (?pd152 s pda ref a b x xa xb refa (?x152 s pda ref a b x xa xb refa)) = Some (ptrFromPAddr x)
 5. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_vs_lookup s
 6. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> unique_table_refs (caps_of_state s)
 7. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 8. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_asid_table (asid_table s) s
 9. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_caps (caps_of_state s) s
 10. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s; refa = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> kheap s (?p'152 s pda ref a b x xa xb refa) = Some (ArchObj (PageDirectory (?pd152 s pda ref a b x xa xb refa)))
 2. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_kernel_mappings s
 3. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> pde_ref (?pd152 s pda ref a b x xa xb refa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some (ptrFromPAddr x)
 4. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_vs_lookup s
 5. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> unique_table_refs (caps_of_state s)
 6. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 7. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_asid_table (asid_table s) s
 8. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_caps (caps_of_state s) s
 9. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s; refa = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 10. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); pgsz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> doE pa <- lookup_error_on_failure False (liftE (get_pde (lookup_pd_slot pd vaddr)) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20)));
returnOk (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))
odE \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))))\<rbrace>, -
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_kernel_mappings s
 2. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> pde_ref (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some (ptrFromPAddr x)
 3. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_vs_lookup s
 4. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> unique_table_refs (caps_of_state s)
 5. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 6. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_asid_table (asid_table s) s
 7. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_caps (caps_of_state s) s
 8. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMSmallPage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSmallPage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s; refa = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 9. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); pgsz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> doE pa <- lookup_error_on_failure False (liftE (get_pde (lookup_pd_slot pd vaddr)) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20)));
returnOk (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))
odE \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))))\<rbrace>, -
 10. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
A total of 11 subgoals... proof (prove)
goal (3 subgoals):
 1. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); pgsz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> doE pa <- lookup_error_on_failure False (liftE (get_pde (lookup_pd_slot pd vaddr)) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20)));
returnOk (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>x. x + pa) [0 , 4 .e. 0x3C]))
odE \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))))\<rbrace>, -
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); pgsz = ARMLargePage; (valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd) s\<rbrakk> \<Longrightarrow> True \<and> True \<and> (\<forall>pda. ako_at (PageDirectory pda) (lookup_pd_slot pd vaddr && ~~ mask pd_bits) s \<longrightarrow> (pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vaddr && mask pd_bits >> 2)) = InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vaddr && mask pd_bits >> 2)) = PageTablePDE x xa xb \<longrightarrow> same_refs (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>xa. xa + (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C])) (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr)))) s) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vaddr && mask pd_bits >> 2)) = SectionPDE x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd vaddr && mask pd_bits >> 2)) = SuperSectionPDE x xa xb \<longrightarrow> True))
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>s pda ref a b x xa xb. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s; ako_at (PageDirectory pda) (pd + (vaddr >> 20 << 2) && ~~ mask pd_bits) s; pda (UCAST(32 \<rightarrow> 12) (pd + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb\<rbrakk> \<Longrightarrow> same_refs (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>xa. xa + (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C])) (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr)))) s
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>s pda ref a b x xa xb. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s; ako_at (PageDirectory pda) (pd + (vaddr >> 20 << 2) && ~~ mask pd_bits) s; pda (UCAST(32 \<rightarrow> 12) (pd + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb; is_aligned pd 14\<rbrakk> \<Longrightarrow> same_refs (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>xa. xa + (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C])) (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr)))) s
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>s pda ref a b x xa xb. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s; ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14\<rbrakk> \<Longrightarrow> same_refs (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>xa. xa + (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C])) (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr)))) s
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>s pda ref a b x xa xb. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s; ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; \<forall>x\<in>- kernel_mapping_slots. valid_pde (pda x) s\<rbrakk> \<Longrightarrow> same_refs (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>xa. xa + (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C])) (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr)))) s
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>s pda ref a b x xa xb. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s; ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s\<rbrakk> \<Longrightarrow> same_refs (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>xa. xa + (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C])) (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr)))) s
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>s pda ref a b x xa xb. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s; ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10\<rbrakk> \<Longrightarrow> same_refs (Inl (LargePagePTE (addrFromPPtr p) (attribs - {Global, ParityEnabled}) rights, map (\<lambda>xa. xa + (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C])) (ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr)))) s
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s; ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits)) s\<rbrakk> \<Longrightarrow> (vaddr >> 12) && mask 8 = ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2 \<and> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s; ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> (vaddr >> 12) && mask 8 = (vaddr >> 12) && 0xFF \<and> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s; ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (7 subgoals):
 1. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> table_cap_ref (ArchObjectCap (PageDirectoryCap pd (Some asid))) = Some (?ref'266 s pda ref a b x xa xb refa)
 2. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> pd \<in> obj_refs (ArchObjectCap (PageDirectoryCap pd (Some asid)))
 3. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_vs_lookup s
 4. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> unique_table_refs (caps_of_state s)
 5. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s; ref = ?ref'266 s pda ref a b x xa xb refa\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 6. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 7. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> ((ref, pd), ?ref'276 s pda ref a b x xa xb refa, ptrFromPAddr x) \<in> vs_lookup1 s
 2. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; (?ref'276 s pda ref a b x xa xb refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 4. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s pda a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> \<exists>ko. ko_at ko pd s \<and> (\<exists>r. ?ref'276 s pda [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] a b x xa xb refa = [r, VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<and> (r, ptrFromPAddr x) \<in> vs_refs ko)
 2. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; (?ref'276 s pda ref a b x xa xb refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 4. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s pda a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> \<exists>r. ?ref'276 s pda [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] a b x xa xb refa = [r, VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<and> (r, ptrFromPAddr x) \<in> vs_refs (ArchObj (PageDirectory pda))
 2. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; (?ref'276 s pda ref a b x xa xb refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 4. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s pda a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> ?ref'276 s pda [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] a b x xa xb refa = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<and> (VSRef (vaddr >> 20) (Some APageDirectory), ptrFromPAddr x) \<in> vs_refs (ArchObj (PageDirectory pda))
 2. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; (?ref'276 s pda ref a b x xa xb refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 4. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s pda a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> (VSRef (vaddr >> 20) (Some APageDirectory), ptrFromPAddr x) \<in> vs_refs (ArchObj (PageDirectory pda))
 2. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ((VSRef (vaddr >> 20) (Some APageDirectory) # ref) \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 4. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s pda a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> (VSRef (vaddr >> 20) (Some APageDirectory), ptrFromPAddr x) \<in> (\<lambda>x. case x of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x)) ` graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pda x))
 2. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ((VSRef (vaddr >> 20) (Some APageDirectory) # ref) \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 4. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>s pda a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> (VSRef (vaddr >> 20) (Some APageDirectory), ptrFromPAddr x) = (case (UCAST(32 \<rightarrow> 12) (vaddr >> 20), ptrFromPAddr x) of (r, x) \<Rightarrow> (VSRef (UCAST(12 \<rightarrow> 32) r) (Some APageDirectory), x))
 2. \<And>s pda a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> (UCAST(32 \<rightarrow> 12) (vaddr >> 20), ptrFromPAddr x) \<in> graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pda x))
 3. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ((VSRef (vaddr >> 20) (Some APageDirectory) # ref) \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 4. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 5. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s pda a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> (UCAST(32 \<rightarrow> 12) (vaddr >> 20), ptrFromPAddr x) \<in> graph_of (\<lambda>x. if x \<in> kernel_mapping_slots then None else pde_ref (pda x))
 2. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ((VSRef (vaddr >> 20) (Some APageDirectory) # ref) \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 4. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s pda a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots \<and> (UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots \<longrightarrow> pde_ref (PageTablePDE x xa xb) = Some (ptrFromPAddr x))
 2. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ((VSRef (vaddr >> 20) (Some APageDirectory) # ref) \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 4. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ((VSRef (vaddr >> 20) (Some APageDirectory) # ref) \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; (refa \<rhd> ptrFromPAddr x) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 3. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (9 subgoals):
 1. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> ptrFromPAddr x \<notin> set (arm_global_pts (arch_state s))
 2. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_vs_lookup s
 3. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> unique_table_refs (caps_of_state s)
 4. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 5. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_asid_table (asid_table s) s
 6. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_caps (caps_of_state s) s
 7. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s; refa = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 8. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 9. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (12 subgoals):
 1. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> ?x310 s pda ref a b x xa xb refa \<notin> kernel_mapping_slots
 2. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> kheap s (?p'310 s pda ref a b x xa xb refa) = Some (ArchObj (PageDirectory (?pd310 s pda ref a b x xa xb refa)))
 3. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_kernel_mappings s
 4. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> pde_ref (?pd310 s pda ref a b x xa xb refa (?x310 s pda ref a b x xa xb refa)) = Some (ptrFromPAddr x)
 5. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_vs_lookup s
 6. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> unique_table_refs (caps_of_state s)
 7. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 8. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_asid_table (asid_table s) s
 9. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_caps (caps_of_state s) s
 10. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s; refa = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> kheap s (?p'310 s pda ref a b x xa xb refa) = Some (ArchObj (PageDirectory (?pd310 s pda ref a b x xa xb refa)))
 2. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_kernel_mappings s
 3. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> pde_ref (?pd310 s pda ref a b x xa xb refa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some (ptrFromPAddr x)
 4. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_vs_lookup s
 5. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> unique_table_refs (caps_of_state s)
 6. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 7. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_asid_table (asid_table s) s
 8. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_caps (caps_of_state s) s
 9. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s; refa = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 10. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_kernel_mappings s
 2. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> pde_ref (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some (ptrFromPAddr x)
 3. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_vs_lookup s
 4. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> unique_table_refs (caps_of_state s)
 5. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 6. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_asid_table (asid_table s) s
 7. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s\<rbrakk> \<Longrightarrow> valid_caps (caps_of_state s) s
 8. \<And>s pda ref a b x xa xb refa. \<lbrakk>pgsz = ARMLargePage; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMLargePage (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); ako_at (PageDirectory pda) pd s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb; is_aligned pd 14; is_aligned (ptrFromPAddr x) 10; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x) s; refa = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 9. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 10. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))))\<rbrace>, -
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); pgsz = ARMSection; (valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd) s\<rbrakk> \<Longrightarrow> same_refs (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [lookup_pd_slot pd vaddr])) (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr)))) s
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>s ref a b. \<lbrakk>pgsz = ARMSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s\<rbrakk> \<Longrightarrow> same_refs (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [pd + (vaddr >> 20 << 2)])) (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr)))) s
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>s ref a b. \<lbrakk>pgsz = ARMSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s; is_aligned pd 14\<rbrakk> \<Longrightarrow> same_refs (Inr (SectionPDE (addrFromPPtr p) (attribs - {Global}) 0 rights, [pd + (vaddr >> 20 << 2)])) (ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr)))) s
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s; is_aligned pd 14; (refa \<rhd> (pd + (vaddr >> 20 << 2) && ~~ mask pd_bits)) s\<rbrakk> \<Longrightarrow> vaddr >> 20 = pd + (vaddr >> 20 << 2) && mask pd_bits >> 2 \<and> [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s; is_aligned pd 14; (refa \<rhd> pd) s\<rbrakk> \<Longrightarrow> [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s\<rbrakk> \<Longrightarrow> [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s\<rbrakk> \<Longrightarrow> table_cap_ref (ArchObjectCap (PageDirectoryCap pd (Some asid))) = Some (?ref'347 s ref a b refa)
 2. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s\<rbrakk> \<Longrightarrow> pd \<in> obj_refs (ArchObjectCap (PageDirectoryCap pd (Some asid)))
 3. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s\<rbrakk> \<Longrightarrow> valid_vs_lookup s
 4. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s\<rbrakk> \<Longrightarrow> unique_table_refs (caps_of_state s)
 5. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s; ref = ?ref'347 s ref a b refa\<rbrakk> \<Longrightarrow> [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 6. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 2. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (8 subgoals):
 1. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> pd \<notin> set (arm_global_pts (arch_state s))
 2. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> valid_vs_lookup s
 3. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> unique_table_refs (caps_of_state s)
 4. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 5. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> valid_asid_table (asid_table s) s
 6. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> valid_caps (caps_of_state s) s
 7. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ref = refa\<rbrakk> \<Longrightarrow> [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 8. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (7 subgoals):
 1. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> valid_vs_lookup s
 2. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> unique_table_refs (caps_of_state s)
 3. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 4. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> valid_asid_table (asid_table s) s
 5. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> valid_caps (caps_of_state s) s
 6. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ref = refa\<rbrakk> \<Longrightarrow> [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa
 7. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd\<rbrace> returnOk (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) \<lbrace>\<lambda>rv. same_refs rv (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))))\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>vaddr < kernel_base \<and> cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); pgsz = ARMSuperSection; (valid_arch_state and valid_vspace_objs and valid_vs_lookup and (\<lambda>s. unique_table_refs (caps_of_state s)) and pspace_aligned and valid_objs and valid_kernel_mappings and (\<lambda>s. \<exists>ref. (ref \<rhd> pd) s) and (\<lambda>s. \<exists>a b. cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s) and typ_at (AArch APageDirectory) pd) s\<rbrakk> \<Longrightarrow> same_refs (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) [0 , 4 .e. 0x3C])) (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr)))) s proof (prove)
goal (1 subgoal):
 1. \<And>s ref a b. \<lbrakk>pgsz = ARMSuperSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s\<rbrakk> \<Longrightarrow> same_refs (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) [0 , 4 .e. 0x3C])) (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr)))) s proof (prove)
goal (1 subgoal):
 1. \<And>s ref a b. \<lbrakk>pgsz = ARMSuperSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s; is_aligned pd 14\<rbrakk> \<Longrightarrow> same_refs (Inr (SuperSectionPDE (addrFromPPtr p) (attribs - {Global}) rights, map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) [0 , 4 .e. 0x3C])) (ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr)))) s proof (prove)
goal (1 subgoal):
 1. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSuperSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s; is_aligned pd 14; (refa \<rhd> (pd + (vaddr >> 20 << 2) && ~~ mask pd_bits)) s\<rbrakk> \<Longrightarrow> vaddr >> 20 = pd + (vaddr >> 20 << 2) && mask pd_bits >> 2 \<and> [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa proof (prove)
goal (1 subgoal):
 1. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSuperSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap pd (Some asid)))) (a, b) s; is_aligned pd 14; (refa \<rhd> pd) s\<rbrakk> \<Longrightarrow> [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa proof (prove)
goal (1 subgoal):
 1. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSuperSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s\<rbrakk> \<Longrightarrow> [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa proof (prove)
goal (5 subgoals):
 1. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSuperSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s\<rbrakk> \<Longrightarrow> table_cap_ref (ArchObjectCap (PageDirectoryCap pd (Some asid))) = Some (?ref'405 s ref a b refa)
 2. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSuperSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s\<rbrakk> \<Longrightarrow> pd \<in> obj_refs (ArchObjectCap (PageDirectoryCap pd (Some asid)))
 3. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSuperSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s\<rbrakk> \<Longrightarrow> valid_vs_lookup s
 4. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSuperSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s\<rbrakk> \<Longrightarrow> unique_table_refs (caps_of_state s)
 5. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSuperSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s; ref = ?ref'405 s ref a b refa\<rbrakk> \<Longrightarrow> [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa proof (prove)
goal (1 subgoal):
 1. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSuperSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; (ref \<rhd> pd) s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa proof (prove)
goal (7 subgoals):
 1. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSuperSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> pd \<notin> set (arm_global_pts (arch_state s))
 2. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSuperSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> valid_vs_lookup s
 3. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSuperSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> unique_table_refs (caps_of_state s)
 4. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSuperSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 5. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSuperSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> valid_asid_table (asid_table s) s
 6. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSuperSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> valid_caps (caps_of_state s) s
 7. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSuperSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ref = refa\<rbrakk> \<Longrightarrow> [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa proof (prove)
goal (6 subgoals):
 1. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSuperSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> valid_vs_lookup s
 2. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSuperSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> unique_table_refs (caps_of_state s)
 3. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSuperSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 4. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSuperSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> valid_asid_table (asid_table s) s
 5. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSuperSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]\<rbrakk> \<Longrightarrow> valid_caps (caps_of_state s) s
 6. \<And>s ref a b refa. \<lbrakk>pgsz = ARMSuperSection; vaddr < kernel_base; cap = ArchObjectCap (PageCap dev p rights' ARMSuperSection (Some (asid, vaddr))); valid_arch_state s; valid_vspace_objs s; valid_vs_lookup s; unique_table_refs (caps_of_state s); pspace_aligned s; valid_objs s; valid_kernel_mappings s; typ_at (AArch APageDirectory) pd s; caps_of_state s (a, b) = Some (ArchObjectCap (PageDirectoryCap pd (Some asid))); is_aligned pd 14; (refa \<rhd> pd) s; ref = [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; ref = refa\<rbrakk> \<Longrightarrow> [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] = refa proof (prove)
goal:
No subgoals!