theory ArchVSpace_AI

lemma unmap_page_unmapped:
  "\<lbrace>pspace_aligned and valid_vspace_objs and data_at sz pptr and
    valid_objs and (\<lambda>s. valid_asid_table (arm_asid_table (arch_state s)) s) and
    K ((sz = ARMSmallPage \<or> sz = ARMLargePage \<longrightarrow> ref =
              [VSRef ((vaddr >> 12) && mask 8) (Some APageTable),
               VSRef (vaddr >> 20) (Some APageDirectory),
               VSRef (asid && mask asid_low_bits) (Some AASIDPool),
               VSRef (ucast (asid_high_bits_of asid)) None]) \<and>
       (sz = ARMSection \<or> sz = ARMSuperSection \<longrightarrow> ref =
              [VSRef (vaddr >> 20) (Some APageDirectory),
               VSRef (asid && mask asid_low_bits) (Some AASIDPool),
               VSRef (ucast (asid_high_bits_of asid)) None]) \<and>
        p = pptr)\<rbrace>
  unmap_page sz asid vaddr pptr
  \<lbrace>\<lambda>rv s. \<not> (ref \<unrhd> p) s\<rbrace>" apply (rule hoare_gen_asm) 

    (* Establish that pptr reachable, otherwise trivial *)
   apply (rule hoare_name_pre_state2) apply (case_tac "\<not> (ref \<unrhd> p) s") apply (rule hoare_pre(1)[OF unmap_page_no_lookup_pages]) apply clarsimp+ 

     (* This should be somewhere else but isn't *)
   apply (subgoal_tac "\<exists>xs. [0 :: word32, 4 .e. 0x3C] = 0 # xs") prefer 2 apply (simp add: upto_enum_step_def upto_enum_word upt_rec) apply (clarsimp simp: unmap_page_def lookup_pd_slot_def lookup_pt_slot_def Let_def
                        mapM_Cons
                  cong: option.case_cong vmpage_size.case_cong) 

    (* Establish that pde in vsref chain isn't kernel mapping,
       otherwise trivial *)
   apply (case_tac "ucast (vaddr >> 20) \<in> kernel_mapping_slots") apply (case_tac sz) apply ((clarsimp simp: kernel_slot_impossible_vs_lookup_pages | wp)+)[2] apply ((clarsimp simp: kernel_slot_impossible_vs_lookup_pages2 | wp)+)[1] apply ((clarsimp simp: kernel_slot_impossible_vs_lookup_pages2 | wp)+)[1] 

      (* Proper cases *)
   apply (wp store_pte_unmap_page
            mapM_UNIV_wp[OF store_pte_no_lookup_pages]
            get_pte_wp get_pde_wp store_pde_unmap_page
            mapM_UNIV_wp[OF store_pde_no_lookup_pages]
            flush_page_vs_lookup flush_page_vs_lookup_pages
            hoare_vcg_all_lift hoare_vcg_const_imp_lift
            hoare_vcg_imp_lift[OF flush_page_pd_at]
            hoare_vcg_imp_lift[OF flush_page_pt_at]
            find_pd_for_asid_lots
         | wpc | simp add: swp_def check_mapping_pptr_def)+ apply clarsimp apply (case_tac sz, simp_all) apply (drule vs_lookup_pages_pteD) apply (rule conjI[rotated]) apply (fastforce simp add: vs_lookup_pages_eq_ap[THEN fun_cong, symmetric]) apply clarsimp apply (frule_tac p=pd and p'=rv in unique_vs_lookup_pages, erule vs_lookup_pages_vs_lookupI) apply (frule (1) pd_aligned) apply (simp add: vaddr_segment_nonsense[where vaddr=vaddr] vaddr_segment_nonsense2[where vaddr=vaddr]) apply (frule valid_vspace_objsD) apply (clarsimp simp: obj_at_def a_type_def) apply (rule refl) apply assumption apply (simp, drule bspec, fastforce) apply (clarsimp simp: pde_ref_pages_def
                    split: pde.splits
                    dest!: ) apply (frule pt_aligned[rotated]) apply (simp add: obj_at_def a_type_def) apply (simp split: Structures_A.kernel_object.splits arch_kernel_obj.splits, blast) apply (clarsimp simp: obj_at_def) apply (simp add: vaddr_segment_nonsense3[where vaddr=vaddr]
                        vaddr_segment_nonsense4[where vaddr=vaddr]) apply (drule_tac p="ptrFromPAddr x" for x in vs_lookup_vs_lookup_pagesI') apply ((simp add: obj_at_def a_type_def)+)[3] apply (frule_tac p="ptrFromPAddr a" for a in valid_vspace_objsD) apply ((simp add: obj_at_def)+)[2] apply (simp add: ) apply (intro conjI impI) apply (simp add: pt_bits_def pageBits_def mask_def) apply (erule allE[where x="(ucast ((vaddr >> 12) && mask 8))"]) apply (fastforce simp: pte_ref_pages_def mask_def obj_at_def a_type_def data_at_def
                             shiftl_shiftr_id[where n=2,
                                             OF _ less_le_trans[OF and_mask_less'[where n=8]],
                                             unfolded mask_def word_bits_def, simplified]
                      split: pte.splits if_splits) apply ((clarsimp simp: obj_at_def a_type_def data_at_def)+)[2] apply (drule vs_lookup_pages_pteD) apply (rule conjI[rotated]) apply (fastforce simp add: vs_lookup_pages_eq_ap[THEN fun_cong, symmetric]) apply clarsimp apply (frule_tac p=pd and p'=rv in unique_vs_lookup_pages, erule vs_lookup_pages_vs_lookupI) apply (frule (1) pd_aligned) apply (simp add: vaddr_segment_nonsense[where vaddr=vaddr] vaddr_segment_nonsense2[where vaddr=vaddr]) apply (frule valid_vspace_objsD) apply (clarsimp simp: obj_at_def a_type_def) apply (rule refl) apply assumption apply (simp, drule bspec, fastforce) apply (clarsimp simp: pde_ref_pages_def
                   split: pde.splits
                   dest!: ) apply (frule pt_aligned[rotated]) apply (simp add: obj_at_def a_type_def) apply (simp split: Structures_A.kernel_object.splits arch_kernel_obj.splits, blast) apply (clarsimp simp: obj_at_def) apply (simp add: vaddr_segment_nonsense3[where vaddr=vaddr]
                       vaddr_segment_nonsense4[where vaddr=vaddr]) apply (drule_tac p="ptrFromPAddr x" for x in vs_lookup_vs_lookup_pagesI') apply ((simp add: obj_at_def a_type_def)+)[3] apply (frule_tac p="ptrFromPAddr a" for a in valid_vspace_objsD) apply ((simp add: obj_at_def)+)[2] apply (simp add: ) apply (intro conjI impI) apply (simp add: pt_bits_def pageBits_def mask_def) apply (erule allE[where x="(ucast ((vaddr >> 12) && mask 8))"]) apply (fastforce simp: pte_ref_pages_def mask_def obj_at_def a_type_def data_at_def
                             shiftl_shiftr_id[where n=2,
                                             OF _ less_le_trans[OF and_mask_less'[where n=8]],
                                             unfolded mask_def word_bits_def, simplified]
                      split: pte.splits if_splits) apply ((clarsimp simp: obj_at_def a_type_def data_at_def)+)[2] apply (drule vs_lookup_pages_pdeD) apply (rule conjI[rotated]) apply (fastforce simp add: vs_lookup_pages_eq_ap[THEN fun_cong, symmetric]) apply clarsimp apply (frule_tac p=pd and p'=rv in unique_vs_lookup_pages, erule vs_lookup_pages_vs_lookupI) apply (frule (1) pd_aligned) apply (simp add: vaddr_segment_nonsense[where vaddr=vaddr] vaddr_segment_nonsense2[where vaddr=vaddr]) apply (frule valid_vspace_objsD) apply (clarsimp simp: obj_at_def a_type_def) apply (rule refl) apply assumption apply (simp, drule bspec, fastforce) apply (clarsimp simp: pde_ref_pages_def
                  split: pde.splits) apply (clarsimp simp: obj_at_def data_at_def) apply (drule_tac p="rv" in vs_lookup_vs_lookup_pagesI') apply ((simp add: obj_at_def a_type_def)+)[3] apply (frule_tac p="rv" in valid_vspace_objsD) apply ((simp add: obj_at_def)+)[2] apply (fastforce simp: data_at_def) apply (fastforce simp: obj_at_def a_type_def pd_bits_def pageBits_def data_at_def
                   split: pde.splits) apply (fastforce simp: obj_at_def a_type_def data_at_def) apply (drule vs_lookup_pages_pdeD) apply (rule conjI[rotated]) apply (fastforce simp add: vs_lookup_pages_eq_ap[THEN fun_cong, symmetric]) apply clarsimp apply (frule_tac p=pd and p'=rv in unique_vs_lookup_pages, erule vs_lookup_pages_vs_lookupI) apply (frule (1) pd_aligned) apply (simp add: vaddr_segment_nonsense[where vaddr=vaddr] vaddr_segment_nonsense2[where vaddr=vaddr]) apply (frule valid_vspace_objsD) apply (clarsimp simp: obj_at_def a_type_def) apply (rule refl) apply assumption apply (simp, drule bspec, fastforce) apply (clarsimp simp: pde_ref_pages_def
                 split: pde.splits) apply (fastforce simp: obj_at_def data_at_def) apply (drule_tac p="rv" in vs_lookup_vs_lookup_pagesI') apply ((simp add: obj_at_def a_type_def)+)[3] apply (frule_tac p="rv" in valid_vspace_objsD) apply ((simp add: obj_at_def)+)[2] apply (simp add: ) apply (drule bspec[where x="ucast (vaddr >> 20)"], simp) apply (fastforce simp: obj_at_def a_type_def pd_bits_def pageBits_def data_at_def
                  split: pde.splits) apply (clarsimp simp: obj_at_def a_type_def pd_bits_def pageBits_def) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>pspace_aligned and valid_vspace_objs and data_at sz pptr and valid_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and K ((sz = ARMSmallPage \<or> sz = ARMLargePage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) \<and> (sz = ARMSection \<or> sz = ARMSuperSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) \<and> p = pptr)\<rbrace> unmap_page sz asid vaddr pptr \<lbrace>\<lambda>rv s. (ref, p) \<notin> vs_lookup_pages s\<rbrace> proof (prove)
goal (1 subgoal):
 1. (sz = ARMSmallPage \<or> sz = ARMLargePage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) \<and> (sz = ARMSection \<or> sz = ARMSuperSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) \<and> p = pptr \<Longrightarrow> \<lbrace>pspace_aligned and valid_vspace_objs and data_at sz pptr and valid_objs and (\<lambda>s. valid_asid_table (asid_table s) s)\<rbrace> unmap_page sz asid vaddr pptr \<lbrace>\<lambda>rv s. (ref, p) \<notin> vs_lookup_pages s\<rbrace> proof (prove)
goal (1 subgoal):
 1. (sz = ARMSmallPage \<or> sz = ARMLargePage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) \<and> (sz = ARMSection \<or> sz = ARMSuperSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) \<and> p = pptr \<Longrightarrow> \<lbrace>pspace_aligned and valid_vspace_objs and data_at sz pptr and valid_objs and (\<lambda>s. valid_asid_table (asid_table s) s)\<rbrace> unmap_page sz asid vaddr pptr \<lbrace>\<lambda>rv s. (ref, p) \<notin> vs_lookup_pages s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s. (sz = ARMSmallPage \<or> sz = ARMLargePage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) \<and> (sz = ARMSection \<or> sz = ARMSuperSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) \<and> p = pptr \<Longrightarrow> \<lbrace>pspace_aligned and valid_vspace_objs and data_at sz pptr and valid_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and (=) s\<rbrace> unmap_page sz asid vaddr pptr \<lbrace>\<lambda>rv s. (ref, p) \<notin> vs_lookup_pages s\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>(sz = ARMSmallPage \<or> sz = ARMLargePage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) \<and> (sz = ARMSection \<or> sz = ARMSuperSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) \<and> p = pptr; (ref, p) \<notin> vs_lookup_pages s\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned and valid_vspace_objs and data_at sz pptr and valid_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and (=) s\<rbrace> unmap_page sz asid vaddr pptr \<lbrace>\<lambda>rv s. (ref, p) \<notin> vs_lookup_pages s\<rbrace>
 2. \<And>s. \<lbrakk>(sz = ARMSmallPage \<or> sz = ARMLargePage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) \<and> (sz = ARMSection \<or> sz = ARMSuperSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) \<and> p = pptr; \<not> (ref, p) \<notin> vs_lookup_pages s\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned and valid_vspace_objs and data_at sz pptr and valid_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and (=) s\<rbrace> unmap_page sz asid vaddr pptr \<lbrace>\<lambda>rv s. (ref, p) \<notin> vs_lookup_pages s\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>(sz = ARMSmallPage \<or> sz = ARMLargePage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) \<and> (sz = ARMSection \<or> sz = ARMSuperSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) \<and> p = pptr; (ref, p) \<notin> vs_lookup_pages s; (pspace_aligned and valid_vspace_objs and data_at sz pptr and valid_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and (=) s) sa\<rbrakk> \<Longrightarrow> (ref, p) \<notin> vs_lookup_pages sa
 2. \<And>s. \<lbrakk>(sz = ARMSmallPage \<or> sz = ARMLargePage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) \<and> (sz = ARMSection \<or> sz = ARMSuperSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) \<and> p = pptr; \<not> (ref, p) \<notin> vs_lookup_pages s\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned and valid_vspace_objs and data_at sz pptr and valid_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and (=) s\<rbrace> unmap_page sz asid vaddr pptr \<lbrace>\<lambda>rv s. (ref, p) \<notin> vs_lookup_pages s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>(ref \<unrhd> pptr) s; sz = ARMSmallPage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMLargePage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSuperSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned and valid_vspace_objs and data_at sz pptr and valid_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and (=) s\<rbrace> unmap_page sz asid vaddr pptr \<lbrace>\<lambda>rv s. (ref, pptr) \<notin> vs_lookup_pages s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>(ref \<unrhd> pptr) s; sz = ARMSmallPage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMLargePage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSuperSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned and valid_vspace_objs and data_at sz pptr and valid_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and (=) s\<rbrace> unmap_page sz asid vaddr pptr \<lbrace>\<lambda>rv s. (ref, pptr) \<notin> vs_lookup_pages s\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>(ref \<unrhd> pptr) s; sz = ARMSmallPage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMLargePage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSuperSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; \<exists>xs. [0 , 4 .e. 0x3C] = 0 # xs\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned and valid_vspace_objs and data_at sz pptr and valid_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and (=) s\<rbrace> unmap_page sz asid vaddr pptr \<lbrace>\<lambda>rv s. (ref, pptr) \<notin> vs_lookup_pages s\<rbrace>
 2. \<And>s. \<lbrakk>(ref \<unrhd> pptr) s; sz = ARMSmallPage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMLargePage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSuperSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr\<rbrakk> \<Longrightarrow> \<exists>xs. [0 , 4 .e. 0x3C] = 0 # xs proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>(ref \<unrhd> pptr) s; sz = ARMSmallPage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMLargePage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSuperSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr\<rbrakk> \<Longrightarrow> \<exists>xs. [0 , 4 .e. 0x3C] = 0 # xs
 2. \<And>s. \<lbrakk>(ref \<unrhd> pptr) s; sz = ARMSmallPage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMLargePage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSuperSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; \<exists>xs. [0 , 4 .e. 0x3C] = 0 # xs\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned and valid_vspace_objs and data_at sz pptr and valid_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and (=) s\<rbrace> unmap_page sz asid vaddr pptr \<lbrace>\<lambda>rv s. (ref, pptr) \<notin> vs_lookup_pages s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>(ref \<unrhd> pptr) s; sz = ARMSmallPage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMLargePage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSuperSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; \<exists>xs. [0 , 4 .e. 0x3C] = 0 # xs\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned and valid_vspace_objs and data_at sz pptr and valid_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and (=) s\<rbrace> unmap_page sz asid vaddr pptr \<lbrace>\<lambda>rv s. (ref, pptr) \<notin> vs_lookup_pages s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s xs. \<lbrakk>(ref \<unrhd> pptr) s; sz = ARMSmallPage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMLargePage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSuperSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned and valid_vspace_objs and data_at sz pptr and valid_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and (=) s\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- liftE (get_pde (pd + (vaddr >> 20 << 2))) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20));
y <- throw_on_false undefined (check_mapping_pptr pptr ARMSmallPage (Inl p));
liftE (do y <- store_pte p InvalidPTE;
do_machine_op (cleanByVA_PoU p (addrFromPPtr p))
od)
odE | ARMLargePage \<Rightarrow> doE p <- liftE (get_pde (pd + (vaddr >> 20 << 2))) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20));
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- do y <- store_pte p InvalidPTE;
ys <- mapM (swp store_pte InvalidPTE) (map (\<lambda>x. x + p) xs);
return (() # ys)
od;
do_machine_op (cleanCacheRange_PoU p (last_byte_pte (if xs = [] then p else last (map (\<lambda>x. x + p) xs))) (addrFromPPtr p))
od)
odE | ARMSection \<Rightarrow> doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (pd + (vaddr >> 20 << 2))));
liftE (do y <- store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE;
do_machine_op (cleanByVA_PoU (pd + (vaddr >> 20 << 2)) (addrFromPPtr (pd + (vaddr >> 20 << 2))))
od)
odE | ARMSuperSection \<Rightarrow> doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (pd + (vaddr >> 20 << 2))));
liftE (do y <- assert (pd + (vaddr >> 20 << 2) && mask 6 = 0);
y <- do y <- store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE;
ys <- mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) xs);
return (() # ys)
od;
do_machine_op (cleanCacheRange_PoU (pd + (vaddr >> 20 << 2)) (last_byte_pde (if xs = [] then pd + (vaddr >> 20 << 2) else last (map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) xs))) (addrFromPPtr (pd + (vaddr >> 20 << 2))))
od)
odE;
liftE (flush_page sz pd asid vaddr)
odE <catch> (\<lambda>y. return ()) \<lbrace>\<lambda>rv s. (ref, pptr) \<notin> vs_lookup_pages s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s xs. \<lbrakk>(ref \<unrhd> pptr) s; sz = ARMSmallPage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMLargePage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSuperSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned and valid_vspace_objs and data_at sz pptr and valid_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and (=) s\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- liftE (get_pde (pd + (vaddr >> 20 << 2))) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20));
y <- throw_on_false undefined (check_mapping_pptr pptr ARMSmallPage (Inl p));
liftE (do y <- store_pte p InvalidPTE;
do_machine_op (cleanByVA_PoU p (addrFromPPtr p))
od)
odE | ARMLargePage \<Rightarrow> doE p <- liftE (get_pde (pd + (vaddr >> 20 << 2))) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20));
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- do y <- store_pte p InvalidPTE;
ys <- mapM (swp store_pte InvalidPTE) (map (\<lambda>x. x + p) xs);
return (() # ys)
od;
do_machine_op (cleanCacheRange_PoU p (last_byte_pte (if xs = [] then p else last (map (\<lambda>x. x + p) xs))) (addrFromPPtr p))
od)
odE | ARMSection \<Rightarrow> doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (pd + (vaddr >> 20 << 2))));
liftE (do y <- store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE;
do_machine_op (cleanByVA_PoU (pd + (vaddr >> 20 << 2)) (addrFromPPtr (pd + (vaddr >> 20 << 2))))
od)
odE | ARMSuperSection \<Rightarrow> doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (pd + (vaddr >> 20 << 2))));
liftE (do y <- assert (pd + (vaddr >> 20 << 2) && mask 6 = 0);
y <- do y <- store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE;
ys <- mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) xs);
return (() # ys)
od;
do_machine_op (cleanCacheRange_PoU (pd + (vaddr >> 20 << 2)) (last_byte_pde (if xs = [] then pd + (vaddr >> 20 << 2) else last (map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) xs))) (addrFromPPtr (pd + (vaddr >> 20 << 2))))
od)
odE;
liftE (flush_page sz pd asid vaddr)
odE <catch> (\<lambda>y. return ()) \<lbrace>\<lambda>rv s. (ref, pptr) \<notin> vs_lookup_pages s\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s xs. \<lbrakk>(ref \<unrhd> pptr) s; sz = ARMSmallPage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMLargePage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSuperSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<in> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned and valid_vspace_objs and data_at sz pptr and valid_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and (=) s\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- liftE (get_pde (pd + (vaddr >> 20 << 2))) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20));
y <- throw_on_false undefined (check_mapping_pptr pptr ARMSmallPage (Inl p));
liftE (do y <- store_pte p InvalidPTE;
do_machine_op (cleanByVA_PoU p (addrFromPPtr p))
od)
odE | ARMLargePage \<Rightarrow> doE p <- liftE (get_pde (pd + (vaddr >> 20 << 2))) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20));
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- do y <- store_pte p InvalidPTE;
ys <- mapM (swp store_pte InvalidPTE) (map (\<lambda>x. x + p) xs);
return (() # ys)
od;
do_machine_op (cleanCacheRange_PoU p (last_byte_pte (if xs = [] then p else last (map (\<lambda>x. x + p) xs))) (addrFromPPtr p))
od)
odE | ARMSection \<Rightarrow> doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (pd + (vaddr >> 20 << 2))));
liftE (do y <- store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE;
do_machine_op (cleanByVA_PoU (pd + (vaddr >> 20 << 2)) (addrFromPPtr (pd + (vaddr >> 20 << 2))))
od)
odE | ARMSuperSection \<Rightarrow> doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (pd + (vaddr >> 20 << 2))));
liftE (do y <- assert (pd + (vaddr >> 20 << 2) && mask 6 = 0);
y <- do y <- store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE;
ys <- mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) xs);
return (() # ys)
od;
do_machine_op (cleanCacheRange_PoU (pd + (vaddr >> 20 << 2)) (last_byte_pde (if xs = [] then pd + (vaddr >> 20 << 2) else last (map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) xs))) (addrFromPPtr (pd + (vaddr >> 20 << 2))))
od)
odE;
liftE (flush_page sz pd asid vaddr)
odE <catch> (\<lambda>y. return ()) \<lbrace>\<lambda>rv s. (ref, pptr) \<notin> vs_lookup_pages s\<rbrace>
 2. \<And>s xs. \<lbrakk>(ref \<unrhd> pptr) s; sz = ARMSmallPage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMLargePage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSuperSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned and valid_vspace_objs and data_at sz pptr and valid_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and (=) s\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- liftE (get_pde (pd + (vaddr >> 20 << 2))) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20));
y <- throw_on_false undefined (check_mapping_pptr pptr ARMSmallPage (Inl p));
liftE (do y <- store_pte p InvalidPTE;
do_machine_op (cleanByVA_PoU p (addrFromPPtr p))
od)
odE | ARMLargePage \<Rightarrow> doE p <- liftE (get_pde (pd + (vaddr >> 20 << 2))) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20));
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- do y <- store_pte p InvalidPTE;
ys <- mapM (swp store_pte InvalidPTE) (map (\<lambda>x. x + p) xs);
return (() # ys)
od;
do_machine_op (cleanCacheRange_PoU p (last_byte_pte (if xs = [] then p else last (map (\<lambda>x. x + p) xs))) (addrFromPPtr p))
od)
odE | ARMSection \<Rightarrow> doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (pd + (vaddr >> 20 << 2))));
liftE (do y <- store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE;
do_machine_op (cleanByVA_PoU (pd + (vaddr >> 20 << 2)) (addrFromPPtr (pd + (vaddr >> 20 << 2))))
od)
odE | ARMSuperSection \<Rightarrow> doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (pd + (vaddr >> 20 << 2))));
liftE (do y <- assert (pd + (vaddr >> 20 << 2) && mask 6 = 0);
y <- do y <- store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE;
ys <- mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) xs);
return (() # ys)
od;
do_machine_op (cleanCacheRange_PoU (pd + (vaddr >> 20 << 2)) (last_byte_pde (if xs = [] then pd + (vaddr >> 20 << 2) else last (map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) xs))) (addrFromPPtr (pd + (vaddr >> 20 << 2))))
od)
odE;
liftE (flush_page sz pd asid vaddr)
odE <catch> (\<lambda>y. return ()) \<lbrace>\<lambda>rv s. (ref, pptr) \<notin> vs_lookup_pages s\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>s xs. \<lbrakk>(ref \<unrhd> pptr) s; sz = ARMSmallPage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMLargePage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSuperSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<in> kernel_mapping_slots; sz = ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned and valid_vspace_objs and data_at sz pptr and valid_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and (=) s\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- liftE (get_pde (pd + (vaddr >> 20 << 2))) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20));
y <- throw_on_false undefined (check_mapping_pptr pptr ARMSmallPage (Inl p));
liftE (do y <- store_pte p InvalidPTE;
do_machine_op (cleanByVA_PoU p (addrFromPPtr p))
od)
odE | ARMLargePage \<Rightarrow> doE p <- liftE (get_pde (pd + (vaddr >> 20 << 2))) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20));
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- do y <- store_pte p InvalidPTE;
ys <- mapM (swp store_pte InvalidPTE) (map (\<lambda>x. x + p) xs);
return (() # ys)
od;
do_machine_op (cleanCacheRange_PoU p (last_byte_pte (if xs = [] then p else last (map (\<lambda>x. x + p) xs))) (addrFromPPtr p))
od)
odE | ARMSection \<Rightarrow> doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (pd + (vaddr >> 20 << 2))));
liftE (do y <- store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE;
do_machine_op (cleanByVA_PoU (pd + (vaddr >> 20 << 2)) (addrFromPPtr (pd + (vaddr >> 20 << 2))))
od)
odE | ARMSuperSection \<Rightarrow> doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (pd + (vaddr >> 20 << 2))));
liftE (do y <- assert (pd + (vaddr >> 20 << 2) && mask 6 = 0);
y <- do y <- store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE;
ys <- mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) xs);
return (() # ys)
od;
do_machine_op (cleanCacheRange_PoU (pd + (vaddr >> 20 << 2)) (last_byte_pde (if xs = [] then pd + (vaddr >> 20 << 2) else last (map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) xs))) (addrFromPPtr (pd + (vaddr >> 20 << 2))))
od)
odE;
liftE (flush_page sz pd asid vaddr)
odE <catch> (\<lambda>y. return ()) \<lbrace>\<lambda>rv s. (ref, pptr) \<notin> vs_lookup_pages s\<rbrace>
 2. \<And>s xs. \<lbrakk>(ref \<unrhd> pptr) s; sz = ARMSmallPage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMLargePage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSuperSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<in> kernel_mapping_slots; sz = ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned and valid_vspace_objs and data_at sz pptr and valid_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and (=) s\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- liftE (get_pde (pd + (vaddr >> 20 << 2))) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20));
y <- throw_on_false undefined (check_mapping_pptr pptr ARMSmallPage (Inl p));
liftE (do y <- store_pte p InvalidPTE;
do_machine_op (cleanByVA_PoU p (addrFromPPtr p))
od)
odE | ARMLargePage \<Rightarrow> doE p <- liftE (get_pde (pd + (vaddr >> 20 << 2))) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20));
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- do y <- store_pte p InvalidPTE;
ys <- mapM (swp store_pte InvalidPTE) (map (\<lambda>x. x + p) xs);
return (() # ys)
od;
do_machine_op (cleanCacheRange_PoU p (last_byte_pte (if xs = [] then p else last (map (\<lambda>x. x + p) xs))) (addrFromPPtr p))
od)
odE | ARMSection \<Rightarrow> doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (pd + (vaddr >> 20 << 2))));
liftE (do y <- store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE;
do_machine_op (cleanByVA_PoU (pd + (vaddr >> 20 << 2)) (addrFromPPtr (pd + (vaddr >> 20 << 2))))
od)
odE | ARMSuperSection \<Rightarrow> doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (pd + (vaddr >> 20 << 2))));
liftE (do y <- assert (pd + (vaddr >> 20 << 2) && mask 6 = 0);
y <- do y <- store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE;
ys <- mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) xs);
return (() # ys)
od;
do_machine_op (cleanCacheRange_PoU (pd + (vaddr >> 20 << 2)) (last_byte_pde (if xs = [] then pd + (vaddr >> 20 << 2) else last (map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) xs))) (addrFromPPtr (pd + (vaddr >> 20 << 2))))
od)
odE;
liftE (flush_page sz pd asid vaddr)
odE <catch> (\<lambda>y. return ()) \<lbrace>\<lambda>rv s. (ref, pptr) \<notin> vs_lookup_pages s\<rbrace>
 3. \<And>s xs. \<lbrakk>(ref \<unrhd> pptr) s; sz = ARMSmallPage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMLargePage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSuperSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<in> kernel_mapping_slots; sz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned and valid_vspace_objs and data_at sz pptr and valid_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and (=) s\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- liftE (get_pde (pd + (vaddr >> 20 << 2))) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20));
y <- throw_on_false undefined (check_mapping_pptr pptr ARMSmallPage (Inl p));
liftE (do y <- store_pte p InvalidPTE;
do_machine_op (cleanByVA_PoU p (addrFromPPtr p))
od)
odE | ARMLargePage \<Rightarrow> doE p <- liftE (get_pde (pd + (vaddr >> 20 << 2))) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20));
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- do y <- store_pte p InvalidPTE;
ys <- mapM (swp store_pte InvalidPTE) (map (\<lambda>x. x + p) xs);
return (() # ys)
od;
do_machine_op (cleanCacheRange_PoU p (last_byte_pte (if xs = [] then p else last (map (\<lambda>x. x + p) xs))) (addrFromPPtr p))
od)
odE | ARMSection \<Rightarrow> doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (pd + (vaddr >> 20 << 2))));
liftE (do y <- store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE;
do_machine_op (cleanByVA_PoU (pd + (vaddr >> 20 << 2)) (addrFromPPtr (pd + (vaddr >> 20 << 2))))
od)
odE | ARMSuperSection \<Rightarrow> doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (pd + (vaddr >> 20 << 2))));
liftE (do y <- assert (pd + (vaddr >> 20 << 2) && mask 6 = 0);
y <- do y <- store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE;
ys <- mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) xs);
return (() # ys)
od;
do_machine_op (cleanCacheRange_PoU (pd + (vaddr >> 20 << 2)) (last_byte_pde (if xs = [] then pd + (vaddr >> 20 << 2) else last (map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) xs))) (addrFromPPtr (pd + (vaddr >> 20 << 2))))
od)
odE;
liftE (flush_page sz pd asid vaddr)
odE <catch> (\<lambda>y. return ()) \<lbrace>\<lambda>rv s. (ref, pptr) \<notin> vs_lookup_pages s\<rbrace>
 4. \<And>s xs. \<lbrakk>(ref \<unrhd> pptr) s; sz = ARMSmallPage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMLargePage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSuperSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<in> kernel_mapping_slots; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned and valid_vspace_objs and data_at sz pptr and valid_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and (=) s\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- liftE (get_pde (pd + (vaddr >> 20 << 2))) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20));
y <- throw_on_false undefined (check_mapping_pptr pptr ARMSmallPage (Inl p));
liftE (do y <- store_pte p InvalidPTE;
do_machine_op (cleanByVA_PoU p (addrFromPPtr p))
od)
odE | ARMLargePage \<Rightarrow> doE p <- liftE (get_pde (pd + (vaddr >> 20 << 2))) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20));
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- do y <- store_pte p InvalidPTE;
ys <- mapM (swp store_pte InvalidPTE) (map (\<lambda>x. x + p) xs);
return (() # ys)
od;
do_machine_op (cleanCacheRange_PoU p (last_byte_pte (if xs = [] then p else last (map (\<lambda>x. x + p) xs))) (addrFromPPtr p))
od)
odE | ARMSection \<Rightarrow> doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (pd + (vaddr >> 20 << 2))));
liftE (do y <- store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE;
do_machine_op (cleanByVA_PoU (pd + (vaddr >> 20 << 2)) (addrFromPPtr (pd + (vaddr >> 20 << 2))))
od)
odE | ARMSuperSection \<Rightarrow> doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (pd + (vaddr >> 20 << 2))));
liftE (do y <- assert (pd + (vaddr >> 20 << 2) && mask 6 = 0);
y <- do y <- store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE;
ys <- mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) xs);
return (() # ys)
od;
do_machine_op (cleanCacheRange_PoU (pd + (vaddr >> 20 << 2)) (last_byte_pde (if xs = [] then pd + (vaddr >> 20 << 2) else last (map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) xs))) (addrFromPPtr (pd + (vaddr >> 20 << 2))))
od)
odE;
liftE (flush_page sz pd asid vaddr)
odE <catch> (\<lambda>y. return ()) \<lbrace>\<lambda>rv s. (ref, pptr) \<notin> vs_lookup_pages s\<rbrace>
 5. \<And>s xs. \<lbrakk>(ref \<unrhd> pptr) s; sz = ARMSmallPage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMLargePage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSuperSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned and valid_vspace_objs and data_at sz pptr and valid_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and (=) s\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- liftE (get_pde (pd + (vaddr >> 20 << 2))) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20));
y <- throw_on_false undefined (check_mapping_pptr pptr ARMSmallPage (Inl p));
liftE (do y <- store_pte p InvalidPTE;
do_machine_op (cleanByVA_PoU p (addrFromPPtr p))
od)
odE | ARMLargePage \<Rightarrow> doE p <- liftE (get_pde (pd + (vaddr >> 20 << 2))) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20));
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- do y <- store_pte p InvalidPTE;
ys <- mapM (swp store_pte InvalidPTE) (map (\<lambda>x. x + p) xs);
return (() # ys)
od;
do_machine_op (cleanCacheRange_PoU p (last_byte_pte (if xs = [] then p else last (map (\<lambda>x. x + p) xs))) (addrFromPPtr p))
od)
odE | ARMSection \<Rightarrow> doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (pd + (vaddr >> 20 << 2))));
liftE (do y <- store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE;
do_machine_op (cleanByVA_PoU (pd + (vaddr >> 20 << 2)) (addrFromPPtr (pd + (vaddr >> 20 << 2))))
od)
odE | ARMSuperSection \<Rightarrow> doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (pd + (vaddr >> 20 << 2))));
liftE (do y <- assert (pd + (vaddr >> 20 << 2) && mask 6 = 0);
y <- do y <- store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE;
ys <- mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) xs);
return (() # ys)
od;
do_machine_op (cleanCacheRange_PoU (pd + (vaddr >> 20 << 2)) (last_byte_pde (if xs = [] then pd + (vaddr >> 20 << 2) else last (map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) xs))) (addrFromPPtr (pd + (vaddr >> 20 << 2))))
od)
odE;
liftE (flush_page sz pd asid vaddr)
odE <catch> (\<lambda>y. return ()) \<lbrace>\<lambda>rv s. (ref, pptr) \<notin> vs_lookup_pages s\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>s xs. \<lbrakk>(ref \<unrhd> pptr) s; sz = ARMSmallPage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMLargePage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSuperSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<in> kernel_mapping_slots; sz = ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned and valid_vspace_objs and data_at sz pptr and valid_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and (=) s\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- liftE (get_pde (pd + (vaddr >> 20 << 2))) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20));
y <- throw_on_false undefined (check_mapping_pptr pptr ARMSmallPage (Inl p));
liftE (do y <- store_pte p InvalidPTE;
do_machine_op (cleanByVA_PoU p (addrFromPPtr p))
od)
odE | ARMLargePage \<Rightarrow> doE p <- liftE (get_pde (pd + (vaddr >> 20 << 2))) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20));
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- do y <- store_pte p InvalidPTE;
ys <- mapM (swp store_pte InvalidPTE) (map (\<lambda>x. x + p) xs);
return (() # ys)
od;
do_machine_op (cleanCacheRange_PoU p (last_byte_pte (if xs = [] then p else last (map (\<lambda>x. x + p) xs))) (addrFromPPtr p))
od)
odE | ARMSection \<Rightarrow> doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (pd + (vaddr >> 20 << 2))));
liftE (do y <- store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE;
do_machine_op (cleanByVA_PoU (pd + (vaddr >> 20 << 2)) (addrFromPPtr (pd + (vaddr >> 20 << 2))))
od)
odE | ARMSuperSection \<Rightarrow> doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (pd + (vaddr >> 20 << 2))));
liftE (do y <- assert (pd + (vaddr >> 20 << 2) && mask 6 = 0);
y <- do y <- store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE;
ys <- mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) xs);
return (() # ys)
od;
do_machine_op (cleanCacheRange_PoU (pd + (vaddr >> 20 << 2)) (last_byte_pde (if xs = [] then pd + (vaddr >> 20 << 2) else last (map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) xs))) (addrFromPPtr (pd + (vaddr >> 20 << 2))))
od)
odE;
liftE (flush_page sz pd asid vaddr)
odE <catch> (\<lambda>y. return ()) \<lbrace>\<lambda>rv s. (ref, pptr) \<notin> vs_lookup_pages s\<rbrace>
 2. \<And>s xs. \<lbrakk>(ref \<unrhd> pptr) s; sz = ARMSmallPage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMLargePage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSuperSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<in> kernel_mapping_slots; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned and valid_vspace_objs and data_at sz pptr and valid_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and (=) s\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- liftE (get_pde (pd + (vaddr >> 20 << 2))) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20));
y <- throw_on_false undefined (check_mapping_pptr pptr ARMSmallPage (Inl p));
liftE (do y <- store_pte p InvalidPTE;
do_machine_op (cleanByVA_PoU p (addrFromPPtr p))
od)
odE | ARMLargePage \<Rightarrow> doE p <- liftE (get_pde (pd + (vaddr >> 20 << 2))) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20));
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- do y <- store_pte p InvalidPTE;
ys <- mapM (swp store_pte InvalidPTE) (map (\<lambda>x. x + p) xs);
return (() # ys)
od;
do_machine_op (cleanCacheRange_PoU p (last_byte_pte (if xs = [] then p else last (map (\<lambda>x. x + p) xs))) (addrFromPPtr p))
od)
odE | ARMSection \<Rightarrow> doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (pd + (vaddr >> 20 << 2))));
liftE (do y <- store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE;
do_machine_op (cleanByVA_PoU (pd + (vaddr >> 20 << 2)) (addrFromPPtr (pd + (vaddr >> 20 << 2))))
od)
odE | ARMSuperSection \<Rightarrow> doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (pd + (vaddr >> 20 << 2))));
liftE (do y <- assert (pd + (vaddr >> 20 << 2) && mask 6 = 0);
y <- do y <- store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE;
ys <- mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) xs);
return (() # ys)
od;
do_machine_op (cleanCacheRange_PoU (pd + (vaddr >> 20 << 2)) (last_byte_pde (if xs = [] then pd + (vaddr >> 20 << 2) else last (map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) xs))) (addrFromPPtr (pd + (vaddr >> 20 << 2))))
od)
odE;
liftE (flush_page sz pd asid vaddr)
odE <catch> (\<lambda>y. return ()) \<lbrace>\<lambda>rv s. (ref, pptr) \<notin> vs_lookup_pages s\<rbrace>
 3. \<And>s xs. \<lbrakk>(ref \<unrhd> pptr) s; sz = ARMSmallPage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMLargePage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSuperSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned and valid_vspace_objs and data_at sz pptr and valid_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and (=) s\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- liftE (get_pde (pd + (vaddr >> 20 << 2))) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20));
y <- throw_on_false undefined (check_mapping_pptr pptr ARMSmallPage (Inl p));
liftE (do y <- store_pte p InvalidPTE;
do_machine_op (cleanByVA_PoU p (addrFromPPtr p))
od)
odE | ARMLargePage \<Rightarrow> doE p <- liftE (get_pde (pd + (vaddr >> 20 << 2))) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20));
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- do y <- store_pte p InvalidPTE;
ys <- mapM (swp store_pte InvalidPTE) (map (\<lambda>x. x + p) xs);
return (() # ys)
od;
do_machine_op (cleanCacheRange_PoU p (last_byte_pte (if xs = [] then p else last (map (\<lambda>x. x + p) xs))) (addrFromPPtr p))
od)
odE | ARMSection \<Rightarrow> doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (pd + (vaddr >> 20 << 2))));
liftE (do y <- store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE;
do_machine_op (cleanByVA_PoU (pd + (vaddr >> 20 << 2)) (addrFromPPtr (pd + (vaddr >> 20 << 2))))
od)
odE | ARMSuperSection \<Rightarrow> doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (pd + (vaddr >> 20 << 2))));
liftE (do y <- assert (pd + (vaddr >> 20 << 2) && mask 6 = 0);
y <- do y <- store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE;
ys <- mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) xs);
return (() # ys)
od;
do_machine_op (cleanCacheRange_PoU (pd + (vaddr >> 20 << 2)) (last_byte_pde (if xs = [] then pd + (vaddr >> 20 << 2) else last (map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) xs))) (addrFromPPtr (pd + (vaddr >> 20 << 2))))
od)
odE;
liftE (flush_page sz pd asid vaddr)
odE <catch> (\<lambda>y. return ()) \<lbrace>\<lambda>rv s. (ref, pptr) \<notin> vs_lookup_pages s\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s xs. \<lbrakk>(ref \<unrhd> pptr) s; sz = ARMSmallPage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMLargePage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSuperSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<in> kernel_mapping_slots; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned and valid_vspace_objs and data_at sz pptr and valid_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and (=) s\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- liftE (get_pde (pd + (vaddr >> 20 << 2))) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20));
y <- throw_on_false undefined (check_mapping_pptr pptr ARMSmallPage (Inl p));
liftE (do y <- store_pte p InvalidPTE;
do_machine_op (cleanByVA_PoU p (addrFromPPtr p))
od)
odE | ARMLargePage \<Rightarrow> doE p <- liftE (get_pde (pd + (vaddr >> 20 << 2))) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20));
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- do y <- store_pte p InvalidPTE;
ys <- mapM (swp store_pte InvalidPTE) (map (\<lambda>x. x + p) xs);
return (() # ys)
od;
do_machine_op (cleanCacheRange_PoU p (last_byte_pte (if xs = [] then p else last (map (\<lambda>x. x + p) xs))) (addrFromPPtr p))
od)
odE | ARMSection \<Rightarrow> doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (pd + (vaddr >> 20 << 2))));
liftE (do y <- store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE;
do_machine_op (cleanByVA_PoU (pd + (vaddr >> 20 << 2)) (addrFromPPtr (pd + (vaddr >> 20 << 2))))
od)
odE | ARMSuperSection \<Rightarrow> doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (pd + (vaddr >> 20 << 2))));
liftE (do y <- assert (pd + (vaddr >> 20 << 2) && mask 6 = 0);
y <- do y <- store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE;
ys <- mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) xs);
return (() # ys)
od;
do_machine_op (cleanCacheRange_PoU (pd + (vaddr >> 20 << 2)) (last_byte_pde (if xs = [] then pd + (vaddr >> 20 << 2) else last (map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) xs))) (addrFromPPtr (pd + (vaddr >> 20 << 2))))
od)
odE;
liftE (flush_page sz pd asid vaddr)
odE <catch> (\<lambda>y. return ()) \<lbrace>\<lambda>rv s. (ref, pptr) \<notin> vs_lookup_pages s\<rbrace>
 2. \<And>s xs. \<lbrakk>(ref \<unrhd> pptr) s; sz = ARMSmallPage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMLargePage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSuperSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned and valid_vspace_objs and data_at sz pptr and valid_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and (=) s\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- liftE (get_pde (pd + (vaddr >> 20 << 2))) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20));
y <- throw_on_false undefined (check_mapping_pptr pptr ARMSmallPage (Inl p));
liftE (do y <- store_pte p InvalidPTE;
do_machine_op (cleanByVA_PoU p (addrFromPPtr p))
od)
odE | ARMLargePage \<Rightarrow> doE p <- liftE (get_pde (pd + (vaddr >> 20 << 2))) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20));
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- do y <- store_pte p InvalidPTE;
ys <- mapM (swp store_pte InvalidPTE) (map (\<lambda>x. x + p) xs);
return (() # ys)
od;
do_machine_op (cleanCacheRange_PoU p (last_byte_pte (if xs = [] then p else last (map (\<lambda>x. x + p) xs))) (addrFromPPtr p))
od)
odE | ARMSection \<Rightarrow> doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (pd + (vaddr >> 20 << 2))));
liftE (do y <- store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE;
do_machine_op (cleanByVA_PoU (pd + (vaddr >> 20 << 2)) (addrFromPPtr (pd + (vaddr >> 20 << 2))))
od)
odE | ARMSuperSection \<Rightarrow> doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (pd + (vaddr >> 20 << 2))));
liftE (do y <- assert (pd + (vaddr >> 20 << 2) && mask 6 = 0);
y <- do y <- store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE;
ys <- mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) xs);
return (() # ys)
od;
do_machine_op (cleanCacheRange_PoU (pd + (vaddr >> 20 << 2)) (last_byte_pde (if xs = [] then pd + (vaddr >> 20 << 2) else last (map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) xs))) (addrFromPPtr (pd + (vaddr >> 20 << 2))))
od)
odE;
liftE (flush_page sz pd asid vaddr)
odE <catch> (\<lambda>y. return ()) \<lbrace>\<lambda>rv s. (ref, pptr) \<notin> vs_lookup_pages s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s xs. \<lbrakk>(ref \<unrhd> pptr) s; sz = ARMSmallPage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMLargePage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSuperSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned and valid_vspace_objs and data_at sz pptr and valid_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and (=) s\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- liftE (get_pde (pd + (vaddr >> 20 << 2))) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20));
y <- throw_on_false undefined (check_mapping_pptr pptr ARMSmallPage (Inl p));
liftE (do y <- store_pte p InvalidPTE;
do_machine_op (cleanByVA_PoU p (addrFromPPtr p))
od)
odE | ARMLargePage \<Rightarrow> doE p <- liftE (get_pde (pd + (vaddr >> 20 << 2))) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20));
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- do y <- store_pte p InvalidPTE;
ys <- mapM (swp store_pte InvalidPTE) (map (\<lambda>x. x + p) xs);
return (() # ys)
od;
do_machine_op (cleanCacheRange_PoU p (last_byte_pte (if xs = [] then p else last (map (\<lambda>x. x + p) xs))) (addrFromPPtr p))
od)
odE | ARMSection \<Rightarrow> doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (pd + (vaddr >> 20 << 2))));
liftE (do y <- store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE;
do_machine_op (cleanByVA_PoU (pd + (vaddr >> 20 << 2)) (addrFromPPtr (pd + (vaddr >> 20 << 2))))
od)
odE | ARMSuperSection \<Rightarrow> doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (pd + (vaddr >> 20 << 2))));
liftE (do y <- assert (pd + (vaddr >> 20 << 2) && mask 6 = 0);
y <- do y <- store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE;
ys <- mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) xs);
return (() # ys)
od;
do_machine_op (cleanCacheRange_PoU (pd + (vaddr >> 20 << 2)) (last_byte_pde (if xs = [] then pd + (vaddr >> 20 << 2) else last (map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) xs))) (addrFromPPtr (pd + (vaddr >> 20 << 2))))
od)
odE;
liftE (flush_page sz pd asid vaddr)
odE <catch> (\<lambda>y. return ()) \<lbrace>\<lambda>rv s. (ref, pptr) \<notin> vs_lookup_pages s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s xs. \<lbrakk>(ref \<unrhd> pptr) s; sz = ARMSmallPage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMLargePage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSuperSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> \<lbrace>pspace_aligned and valid_vspace_objs and data_at sz pptr and valid_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and (=) s\<rbrace> doE pd <- find_pd_for_asid asid;
y <- case sz of ARMSmallPage \<Rightarrow> doE p <- liftE (get_pde (pd + (vaddr >> 20 << 2))) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20));
y <- throw_on_false undefined (check_mapping_pptr pptr ARMSmallPage (Inl p));
liftE (do y <- store_pte p InvalidPTE;
do_machine_op (cleanByVA_PoU p (addrFromPPtr p))
od)
odE | ARMLargePage \<Rightarrow> doE p <- liftE (get_pde (pd + (vaddr >> 20 << 2))) >>=E case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vaddr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20));
y <- throw_on_false undefined (check_mapping_pptr pptr ARMLargePage (Inl p));
liftE (do y <- assert (p && mask 6 = 0);
y <- do y <- store_pte p InvalidPTE;
ys <- mapM (swp store_pte InvalidPTE) (map (\<lambda>x. x + p) xs);
return (() # ys)
od;
do_machine_op (cleanCacheRange_PoU p (last_byte_pte (if xs = [] then p else last (map (\<lambda>x. x + p) xs))) (addrFromPPtr p))
od)
odE | ARMSection \<Rightarrow> doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSection (Inr (pd + (vaddr >> 20 << 2))));
liftE (do y <- store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE;
do_machine_op (cleanByVA_PoU (pd + (vaddr >> 20 << 2)) (addrFromPPtr (pd + (vaddr >> 20 << 2))))
od)
odE | ARMSuperSection \<Rightarrow> doE y <- throw_on_false undefined (check_mapping_pptr pptr ARMSuperSection (Inr (pd + (vaddr >> 20 << 2))));
liftE (do y <- assert (pd + (vaddr >> 20 << 2) && mask 6 = 0);
y <- do y <- store_pde (pd + (vaddr >> 20 << 2)) InvalidPDE;
ys <- mapM (swp store_pde InvalidPDE) (map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) xs);
return (() # ys)
od;
do_machine_op (cleanCacheRange_PoU (pd + (vaddr >> 20 << 2)) (last_byte_pde (if xs = [] then pd + (vaddr >> 20 << 2) else last (map (\<lambda>x. x + (pd + (vaddr >> 20 << 2))) xs))) (addrFromPPtr (pd + (vaddr >> 20 << 2))))
od)
odE;
liftE (flush_page sz pd asid vaddr)
odE <catch> (\<lambda>y. return ()) \<lbrace>\<lambda>rv s. (ref, pptr) \<notin> vs_lookup_pages s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s xs. \<lbrakk>(ref \<unrhd> pptr) s; sz = ARMSmallPage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMLargePage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSuperSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s \<and> valid_vspace_objs s \<and> data_at sz pptr s \<and> valid_objs s \<and> valid_asid_table (asid_table s) s\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (sz = ARMSmallPage \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> (pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = InvalidPDE \<longrightarrow> ([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None], pptr) \<notin> vs_lookup_pages s) \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (\<not> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> ([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None], pptr) \<notin> vs_lookup_pages s))) \<and> ((\<exists>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = SectionPDE x xa xb xc) \<longrightarrow> ([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None], pptr) \<notin> vs_lookup_pages s) \<and> ((\<exists>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = SuperSectionPDE x xa xb) \<longrightarrow> ([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None], pptr) \<notin> vs_lookup_pages s))) \<and> (sz = ARMLargePage \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> (pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = InvalidPDE \<longrightarrow> ([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None], pptr) \<notin> vs_lookup_pages s) \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (\<not> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None], pptr) \<notin> vs_lookup_pages s))) \<and> ((\<exists>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = SectionPDE x xa xb xc) \<longrightarrow> ([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None], pptr) \<notin> vs_lookup_pages s) \<and> ((\<exists>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = SuperSectionPDE x xa xb) \<longrightarrow> ([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None], pptr) \<notin> vs_lookup_pages s))) \<and> (sz = ARMSection \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (\<not> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None], pptr) \<notin> vs_lookup_pages s))) \<and> (sz = ARMSuperSection \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (\<not> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None], pptr) \<notin> vs_lookup_pages s)))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (1 subgoal):
 1. \<And>s xs. \<lbrakk>(ref \<unrhd> pptr) s; sz = ARMSmallPage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMLargePage \<longrightarrow> ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; sz = ARMSuperSection \<longrightarrow> ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at sz pptr s; valid_objs s; valid_asid_table (asid_table s) s\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (sz = ARMSmallPage \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> (pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = InvalidPDE \<longrightarrow> ([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None], pptr) \<notin> vs_lookup_pages s) \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (\<not> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> ([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None], pptr) \<notin> vs_lookup_pages s))) \<and> ((\<exists>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = SectionPDE x xa xb xc) \<longrightarrow> ([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None], pptr) \<notin> vs_lookup_pages s) \<and> ((\<exists>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = SuperSectionPDE x xa xb) \<longrightarrow> ([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None], pptr) \<notin> vs_lookup_pages s))) \<and> (sz = ARMLargePage \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> (pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = InvalidPDE \<longrightarrow> ([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None], pptr) \<notin> vs_lookup_pages s) \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (\<not> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None], pptr) \<notin> vs_lookup_pages s))) \<and> ((\<exists>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = SectionPDE x xa xb xc) \<longrightarrow> ([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None], pptr) \<notin> vs_lookup_pages s) \<and> ((\<exists>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = SuperSectionPDE x xa xb) \<longrightarrow> ([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None], pptr) \<notin> vs_lookup_pages s))) \<and> (sz = ARMSection \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (\<not> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None], pptr) \<notin> vs_lookup_pages s))) \<and> (sz = ARMSuperSection \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (\<not> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None], pptr) \<notin> vs_lookup_pages s)))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (4 subgoals):
 1. \<And>s xs. \<lbrakk>([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 2. \<And>s xs. \<lbrakk>([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 3. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 4. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (4 subgoals):
 1. \<And>s xs. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; \<exists>ap fun pd funa pt funb. ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s \<and> asid_table s (asid_high_bits_of asid) = Some ap \<and> ako_at (ASIDPool fun) ap s \<and> ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pd) s \<and> fun (UCAST(32 \<rightarrow> 10) (asid && mask local.asid_low_bits)) = Some pd \<and> ako_at (PageDirectory funa) pd s \<and> ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s \<and> pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt \<and> ako_at (PageTable funb) pt s \<and> pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 2. \<And>s xs. \<lbrakk>([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 3. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 4. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (5 subgoals):
 1. \<And>s xs. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; \<exists>ap fun pd funa pt funb. ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s \<and> asid_table s (asid_high_bits_of asid) = Some ap \<and> ako_at (ASIDPool fun) ap s \<and> ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pd) s \<and> fun (UCAST(32 \<rightarrow> 10) (asid && mask local.asid_low_bits)) = Some pd \<and> ako_at (PageDirectory funa) pd s \<and> ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s \<and> pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt \<and> ako_at (PageTable funb) pt s \<and> pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr\<rbrakk> \<Longrightarrow> \<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s
 2. \<And>s xs. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; \<exists>ap fun pd funa pt funb. ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s \<and> asid_table s (asid_high_bits_of asid) = Some ap \<and> ako_at (ASIDPool fun) ap s \<and> ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pd) s \<and> fun (UCAST(32 \<rightarrow> 10) (asid && mask local.asid_low_bits)) = Some pd \<and> ako_at (PageDirectory funa) pd s \<and> ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s \<and> pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt \<and> ako_at (PageTable funb) pt s \<and> pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr\<rbrakk> \<Longrightarrow> \<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))
 3. \<And>s xs. \<lbrakk>([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 4. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 5. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (4 subgoals):
 1. \<And>s xs. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; \<exists>ap fun pd funa pt funb. ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s \<and> asid_table s (asid_high_bits_of asid) = Some ap \<and> ako_at (ASIDPool fun) ap s \<and> ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pd) s \<and> fun (UCAST(32 \<rightarrow> 10) (asid && mask local.asid_low_bits)) = Some pd \<and> ako_at (PageDirectory funa) pd s \<and> ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s \<and> pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt \<and> ako_at (PageTable funb) pt s \<and> pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr\<rbrakk> \<Longrightarrow> \<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))
 2. \<And>s xs. \<lbrakk>([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 3. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 4. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (4 subgoals):
 1. \<And>s xs ap rv fun pd funa pt funb pda. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pd) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some pd; ako_at (PageDirectory funa) pd s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt; ako_at (PageTable funb) pt s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb)
 2. \<And>s xs. \<lbrakk>([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 3. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 4. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (4 subgoals):
 1. \<And>s xs ap rv fun pd funa pt funb pda. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pd) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some pd; ako_at (PageDirectory funa) pd s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt; ako_at (PageTable funb) pt s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s; pd = rv\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb)
 2. \<And>s xs. \<lbrakk>([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 3. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 4. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (4 subgoals):
 1. \<And>s xs ap rv fun pd funa pt funb pda. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pd) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some pd; ako_at (PageDirectory funa) pd s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt; ako_at (PageTable funb) pt s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s; pd = rv; is_aligned rv 14\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb)
 2. \<And>s xs. \<lbrakk>([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 3. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 4. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (4 subgoals):
 1. \<And>s xs ap rv fun pd funa pt funb pda. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt; ako_at (PageTable funb) pt s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 2. \<And>s xs. \<lbrakk>([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 3. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 4. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (6 subgoals):
 1. \<And>s xs ap rv fun pd funa pt funb pda. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt; ako_at (PageTable funb) pt s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14\<rbrakk> \<Longrightarrow> ako_at (?ao327 s xs ap rv fun pd funa pt funb pda) rv s
 2. \<And>s xs ap rv fun pd funa pt funb pda. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt; ako_at (PageTable funb) pt s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 3. \<And>s xs ap rv fun pd funa pt funb pda. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt; ako_at (PageTable funb) pt s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14; valid_vspace_obj (?ao327 s xs ap rv fun pd funa pt funb pda) s\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 4. \<And>s xs. \<lbrakk>([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 5. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 6. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (6 subgoals):
 1. \<And>s xs ap rv fun funa pt funb. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; kheap s rv = Some (ArchObj (PageDirectory funa)); ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt; kheap s pt = Some (ArchObj (PageTable funb)); pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; is_aligned rv 14\<rbrakk> \<Longrightarrow> ?ao327 s xs ap rv fun rv funa pt funb funa = PageDirectory funa
 2. \<And>s xs ap rv fun pd funa pt funb pda. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt; ako_at (PageTable funb) pt s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 3. \<And>s xs ap rv fun pd funa pt funb pda. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt; ako_at (PageTable funb) pt s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14; valid_vspace_obj (?ao327 s xs ap rv fun pd funa pt funb pda) s\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 4. \<And>s xs. \<lbrakk>([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 5. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 6. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (5 subgoals):
 1. \<And>s xs ap rv fun pd funa pt funb pda. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt; ako_at (PageTable funb) pt s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 2. \<And>s xs ap rv fun pd funa pt funb pda. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt; ako_at (PageTable funb) pt s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14; valid_vspace_obj (PageDirectory pda) s\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 3. \<And>s xs. \<lbrakk>([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 4. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 5. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (4 subgoals):
 1. \<And>s xs ap rv fun pd funa pt funb pda. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt; ako_at (PageTable funb) pt s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14; valid_vspace_obj (PageDirectory pda) s\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 2. \<And>s xs. \<lbrakk>([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 3. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 4. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (4 subgoals):
 1. \<And>s xs ap rv fun pd funa pt funb pda. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt; ako_at (PageTable funb) pt s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 2. \<And>s xs. \<lbrakk>([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 3. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 4. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (6 subgoals):
 1. \<And>s xs ap rv fun funa funb pda x21 x22 x23. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x21) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x21) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 2. \<And>s xs ap rv fun funa funb pda x31 x32 x33 x34. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x31) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x31) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 3. \<And>s xs ap rv fun funa funb pda x41 x42 x43. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x41) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x41) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 4. \<And>s xs. \<lbrakk>([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 5. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 6. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (7 subgoals):
 1. \<And>s xs ap rv fun funa funb pda x21 x22 x23. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x21) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x21) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> typ_at (AArch APageTable) (?pt382 s xs ap rv fun funa funb pda x21 x22 x23) s
 2. \<And>s xs ap rv fun funa funb pda x21 x22 x23. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x21) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x21) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (?pt382 s xs ap rv fun funa funb pda x21 x22 x23) 10\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 3. \<And>s xs ap rv fun funa funb pda x31 x32 x33 x34. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x31) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x31) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 4. \<And>s xs ap rv fun funa funb pda x41 x42 x43. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x41) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x41) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 5. \<And>s xs. \<lbrakk>([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 6. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 7. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (7 subgoals):
 1. \<And>s xs ap rv fun funa funb pda x21 x22 x23. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable funb)); pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pda)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; funa = pda; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x21) s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> \<exists>ko. kheap s (?pt382 s xs ap rv fun pda funb pda x21 x22 x23) = Some ko \<and> (case ko of CNode sz cspace \<Rightarrow> if well_formed_cnode_n sz cspace then ACapTable sz else AGarbage (cte_level_bits + sz) | TCB tcb \<Rightarrow> ATCB | Endpoint endpoint \<Rightarrow> AEndpoint | Notification notification \<Rightarrow> ANTFN | ArchObj ao \<Rightarrow> AArch (case ao of ASIDPool f \<Rightarrow> AASIDPool | PageTable pt \<Rightarrow> APageTable | PageDirectory pd \<Rightarrow> APageDirectory | DataPage dev sz \<Rightarrow> if dev then ADeviceData sz else AUserData sz)) = AArch APageTable
 2. \<And>s xs ap rv fun funa funb pda x21 x22 x23. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x21) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x21) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (?pt382 s xs ap rv fun funa funb pda x21 x22 x23) 10\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 3. \<And>s xs ap rv fun funa funb pda x31 x32 x33 x34. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x31) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x31) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 4. \<And>s xs ap rv fun funa funb pda x41 x42 x43. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x41) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x41) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 5. \<And>s xs. \<lbrakk>([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 6. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 7. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (6 subgoals):
 1. \<And>s xs ap rv fun funa funb pda x21 x22 x23. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x21) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x21) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 2. \<And>s xs ap rv fun funa funb pda x31 x32 x33 x34. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x31) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x31) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 3. \<And>s xs ap rv fun funa funb pda x41 x42 x43. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x41) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x41) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 4. \<And>s xs. \<lbrakk>([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 5. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 6. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (6 subgoals):
 1. \<And>s xs ap rv fun x21 x22 x23 pt pd pta. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x21) s; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10; kheap s (ptrFromPAddr x21 + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) = Some (ArchObj (PageTable pta))\<rbrakk> \<Longrightarrow> ((case pta (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x21 + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x21 + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pta (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x21 + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage)
 2. \<And>s xs ap rv fun funa funb pda x31 x32 x33 x34. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x31) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x31) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 3. \<And>s xs ap rv fun funa funb pda x41 x42 x43. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x41) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x41) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 4. \<And>s xs. \<lbrakk>([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 5. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 6. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (6 subgoals):
 1. \<And>s xs ap rv fun x21 x22 x23 pt pd pta. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pta)); pte_ref_pages (pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x21) s; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10; pt = pta\<rbrakk> \<Longrightarrow> ((case pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && 0xFF << 2 >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x21 + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && 0xFF << 2 >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage)
 2. \<And>s xs ap rv fun funa funb pda x31 x32 x33 x34. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x31) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x31) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 3. \<And>s xs ap rv fun funa funb pda x41 x42 x43. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x41) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x41) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 4. \<And>s xs. \<lbrakk>([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 5. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 6. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (9 subgoals):
 1. \<And>s xs ap rv fun x21 x22 x23 pt pd pta. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pta)); pte_ref_pages (pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10; pt = pta\<rbrakk> \<Longrightarrow> typ_at (AArch APageTable) (ptrFromPAddr x21) s \<or> typ_at (AArch APageDirectory) (ptrFromPAddr x21) s \<or> typ_at (AArch AASIDPool) (ptrFromPAddr x21) s
 2. \<And>s xs ap rv fun x21 x22 x23 pt pd pta. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pta)); pte_ref_pages (pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10; pt = pta\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 3. \<And>s xs ap rv fun x21 x22 x23 pt pd pta. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pta)); pte_ref_pages (pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10; pt = pta\<rbrakk> \<Longrightarrow> valid_asid_table (asid_table s) s
 4. \<And>s xs ap rv fun x21 x22 x23 pt pd pta. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pta)); pte_ref_pages (pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10; pt = pta; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x21) s\<rbrakk> \<Longrightarrow> ((case pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && 0xFF << 2 >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x21 + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && 0xFF << 2 >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage)
 5. \<And>s xs ap rv fun funa funb pda x31 x32 x33 x34. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x31) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x31) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 6. \<And>s xs ap rv fun funa funb pda x41 x42 x43. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x41) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x41) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 7. \<And>s xs. \<lbrakk>([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 8. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 9. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (6 subgoals):
 1. \<And>s xs ap rv fun x21 x22 x23 pt pd pta. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pta)); pte_ref_pages (pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10; pt = pta; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x21) s\<rbrakk> \<Longrightarrow> ((case pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && 0xFF << 2 >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x21 + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && 0xFF << 2 >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage)
 2. \<And>s xs ap rv fun funa funb pda x31 x32 x33 x34. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x31) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x31) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 3. \<And>s xs ap rv fun funa funb pda x41 x42 x43. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x41) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x41) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 4. \<And>s xs. \<lbrakk>([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 5. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 6. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (8 subgoals):
 1. \<And>s xs ap rv fun x21 x22 x23 pt pd pta. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pta)); pte_ref_pages (pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10; pt = pta; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x21) s\<rbrakk> \<Longrightarrow> ako_at (?ao733 s xs ap rv fun x21 x22 x23 pt pd pta) (ptrFromPAddr x21) s
 2. \<And>s xs ap rv fun x21 x22 x23 pt pd pta. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pta)); pte_ref_pages (pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10; pt = pta; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x21) s\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 3. \<And>s xs ap rv fun x21 x22 x23 pt pd pta. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pta)); pte_ref_pages (pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10; pt = pta; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x21) s; valid_vspace_obj (?ao733 s xs ap rv fun x21 x22 x23 pt pd pta) s\<rbrakk> \<Longrightarrow> ((case pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && 0xFF << 2 >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x21 + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && 0xFF << 2 >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage)
 4. \<And>s xs ap rv fun funa funb pda x31 x32 x33 x34. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x31) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x31) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 5. \<And>s xs ap rv fun funa funb pda x41 x42 x43. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x41) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x41) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 6. \<And>s xs. \<lbrakk>([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 7. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 8. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (6 subgoals):
 1. \<And>s xs ap rv fun x21 x22 x23 pt pd pta. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pta)); pte_ref_pages (pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10; pt = pta; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x21) s; valid_vspace_obj (PageTable pta) s\<rbrakk> \<Longrightarrow> ((case pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && 0xFF << 2 >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x21 + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && 0xFF << 2 >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage)
 2. \<And>s xs ap rv fun funa funb pda x31 x32 x33 x34. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x31) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x31) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 3. \<And>s xs ap rv fun funa funb pda x41 x42 x43. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x41) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x41) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 4. \<And>s xs. \<lbrakk>([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 5. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 6. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (6 subgoals):
 1. \<And>s xs ap rv fun x21 x22 x23 pt pd pta. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pta)); pte_ref_pages (pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10; pt = pta; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x21) s; \<forall>x. valid_pte (pta x) s\<rbrakk> \<Longrightarrow> ((case pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && 0xFF << 2 >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x21 + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && 0xFF << 2 >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage)
 2. \<And>s xs ap rv fun funa funb pda x31 x32 x33 x34. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x31) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x31) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 3. \<And>s xs ap rv fun funa funb pda x41 x42 x43. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x41) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x41) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 4. \<And>s xs. \<lbrakk>([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 5. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 6. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (7 subgoals):
 1. \<And>s xs ap rv fun x21 x22 x23 pt pd pta. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pta)); pte_ref_pages (pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10; pt = pta; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x21) s; \<forall>x. valid_pte (pta x) s; case pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && 0xFF << 2 >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage\<rbrakk> \<Longrightarrow> \<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x21 + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2)
 2. \<And>s xs ap rv fun x21 x22 x23 pt pd pta. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pta)); pte_ref_pages (pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10; pt = pta; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x21) s; \<forall>x. valid_pte (pta x) s\<rbrakk> \<Longrightarrow> case pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && 0xFF << 2 >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage
 3. \<And>s xs ap rv fun funa funb pda x31 x32 x33 x34. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x31) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x31) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 4. \<And>s xs ap rv fun funa funb pda x41 x42 x43. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x41) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x41) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 5. \<And>s xs. \<lbrakk>([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 6. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 7. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (6 subgoals):
 1. \<And>s xs ap rv fun x21 x22 x23 pt pd pta. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pta)); pte_ref_pages (pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10; pt = pta; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x21) s; \<forall>x. valid_pte (pta x) s\<rbrakk> \<Longrightarrow> case pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && 0xFF << 2 >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage
 2. \<And>s xs ap rv fun funa funb pda x31 x32 x33 x34. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x31) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x31) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 3. \<And>s xs ap rv fun funa funb pda x41 x42 x43. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x41) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x41) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 4. \<And>s xs. \<lbrakk>([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 5. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 6. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (6 subgoals):
 1. \<And>s xs ap rv fun x21 x22 x23 pt pd pta. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pta)); pte_ref_pages (pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10; pt = pta; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x21) s; valid_pte (pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) s\<rbrakk> \<Longrightarrow> case pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && 0xFF << 2 >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage
 2. \<And>s xs ap rv fun funa funb pda x31 x32 x33 x34. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x31) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x31) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 3. \<And>s xs ap rv fun funa funb pda x41 x42 x43. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x41) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x41) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 4. \<And>s xs. \<lbrakk>([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 5. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 6. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (5 subgoals):
 1. \<And>s xs ap rv fun funa funb pda x31 x32 x33 x34. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x31) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x31) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 2. \<And>s xs ap rv fun funa funb pda x41 x42 x43. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x41) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSmallPage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSmallPage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x41) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage) \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSmallPage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 3. \<And>s xs. \<lbrakk>([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 4. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 5. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (3 subgoals):
 1. \<And>s xs. \<lbrakk>([VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 2. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 3. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (3 subgoals):
 1. \<And>s xs. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; \<exists>ap fun pd funa pt funb. ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s \<and> asid_table s (asid_high_bits_of asid) = Some ap \<and> ako_at (ASIDPool fun) ap s \<and> ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pd) s \<and> fun (UCAST(32 \<rightarrow> 10) (asid && mask local.asid_low_bits)) = Some pd \<and> ako_at (PageDirectory funa) pd s \<and> ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s \<and> pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt \<and> ako_at (PageTable funb) pt s \<and> pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 2. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 3. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (4 subgoals):
 1. \<And>s xs. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; \<exists>ap fun pd funa pt funb. ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s \<and> asid_table s (asid_high_bits_of asid) = Some ap \<and> ako_at (ASIDPool fun) ap s \<and> ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pd) s \<and> fun (UCAST(32 \<rightarrow> 10) (asid && mask local.asid_low_bits)) = Some pd \<and> ako_at (PageDirectory funa) pd s \<and> ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s \<and> pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt \<and> ako_at (PageTable funb) pt s \<and> pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr\<rbrakk> \<Longrightarrow> \<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s
 2. \<And>s xs. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; \<exists>ap fun pd funa pt funb. ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s \<and> asid_table s (asid_high_bits_of asid) = Some ap \<and> ako_at (ASIDPool fun) ap s \<and> ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pd) s \<and> fun (UCAST(32 \<rightarrow> 10) (asid && mask local.asid_low_bits)) = Some pd \<and> ako_at (PageDirectory funa) pd s \<and> ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s \<and> pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt \<and> ako_at (PageTable funb) pt s \<and> pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr\<rbrakk> \<Longrightarrow> \<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))
 3. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 4. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (3 subgoals):
 1. \<And>s xs. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; \<exists>ap fun pd funa pt funb. ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s \<and> asid_table s (asid_high_bits_of asid) = Some ap \<and> ako_at (ASIDPool fun) ap s \<and> ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pd) s \<and> fun (UCAST(32 \<rightarrow> 10) (asid && mask local.asid_low_bits)) = Some pd \<and> ako_at (PageDirectory funa) pd s \<and> ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s \<and> pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt \<and> ako_at (PageTable funb) pt s \<and> pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr\<rbrakk> \<Longrightarrow> \<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb))
 2. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 3. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (3 subgoals):
 1. \<And>s xs ap rv fun pd funa pt funb pda. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pd) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some pd; ako_at (PageDirectory funa) pd s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt; ako_at (PageTable funb) pt s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb)
 2. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 3. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (3 subgoals):
 1. \<And>s xs ap rv fun pd funa pt funb pda. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pd) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some pd; ako_at (PageDirectory funa) pd s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt; ako_at (PageTable funb) pt s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s; pd = rv\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb)
 2. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 3. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (3 subgoals):
 1. \<And>s xs ap rv fun pd funa pt funb pda. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pd) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some pd; ako_at (PageDirectory funa) pd s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt; ako_at (PageTable funb) pt s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s; pd = rv; is_aligned rv 14\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) \<noteq> SuperSectionPDE x xa xb)
 2. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 3. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (3 subgoals):
 1. \<And>s xs ap rv fun pd funa pt funb pda. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt; ako_at (PageTable funb) pt s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 2. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 3. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (5 subgoals):
 1. \<And>s xs ap rv fun pd funa pt funb pda. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt; ako_at (PageTable funb) pt s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14\<rbrakk> \<Longrightarrow> ako_at (?ao853 s xs ap rv fun pd funa pt funb pda) rv s
 2. \<And>s xs ap rv fun pd funa pt funb pda. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt; ako_at (PageTable funb) pt s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 3. \<And>s xs ap rv fun pd funa pt funb pda. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt; ako_at (PageTable funb) pt s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14; valid_vspace_obj (?ao853 s xs ap rv fun pd funa pt funb pda) s\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 4. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 5. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (5 subgoals):
 1. \<And>s xs ap rv fun funa pt funb. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; kheap s rv = Some (ArchObj (PageDirectory funa)); ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt; kheap s pt = Some (ArchObj (PageTable funb)); pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; is_aligned rv 14\<rbrakk> \<Longrightarrow> ?ao853 s xs ap rv fun rv funa pt funb funa = PageDirectory funa
 2. \<And>s xs ap rv fun pd funa pt funb pda. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt; ako_at (PageTable funb) pt s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 3. \<And>s xs ap rv fun pd funa pt funb pda. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt; ako_at (PageTable funb) pt s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14; valid_vspace_obj (?ao853 s xs ap rv fun pd funa pt funb pda) s\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 4. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 5. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (4 subgoals):
 1. \<And>s xs ap rv fun pd funa pt funb pda. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt; ako_at (PageTable funb) pt s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 2. \<And>s xs ap rv fun pd funa pt funb pda. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt; ako_at (PageTable funb) pt s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14; valid_vspace_obj (PageDirectory pda) s\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 3. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 4. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (3 subgoals):
 1. \<And>s xs ap rv fun pd funa pt funb pda. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt; ako_at (PageTable funb) pt s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14; valid_vspace_obj (PageDirectory pda) s\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 2. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 3. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (3 subgoals):
 1. \<And>s xs ap rv fun pd funa pt funb pda. \<lbrakk>ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pt) s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pt; ako_at (PageTable funb) pt s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 2. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 3. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (5 subgoals):
 1. \<And>s xs ap rv fun funa funb pda x21 x22 x23. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x21) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x21) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 2. \<And>s xs ap rv fun funa funb pda x31 x32 x33 x34. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x31) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x31) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 3. \<And>s xs ap rv fun funa funb pda x41 x42 x43. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x41) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x41) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 4. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 5. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (6 subgoals):
 1. \<And>s xs ap rv fun funa funb pda x21 x22 x23. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x21) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x21) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> typ_at (AArch APageTable) (?pt908 s xs ap rv fun funa funb pda x21 x22 x23) s
 2. \<And>s xs ap rv fun funa funb pda x21 x22 x23. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x21) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x21) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (?pt908 s xs ap rv fun funa funb pda x21 x22 x23) 10\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 3. \<And>s xs ap rv fun funa funb pda x31 x32 x33 x34. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x31) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x31) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 4. \<And>s xs ap rv fun funa funb pda x41 x42 x43. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x41) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x41) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 5. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 6. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (6 subgoals):
 1. \<And>s xs ap rv fun funa funb pda x21 x22 x23. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable funb)); pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pda)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; funa = pda; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x21) s; pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> \<exists>ko. kheap s (?pt908 s xs ap rv fun pda funb pda x21 x22 x23) = Some ko \<and> (case ko of CNode sz cspace \<Rightarrow> if well_formed_cnode_n sz cspace then ACapTable sz else AGarbage (cte_level_bits + sz) | TCB tcb \<Rightarrow> ATCB | Endpoint endpoint \<Rightarrow> AEndpoint | Notification notification \<Rightarrow> ANTFN | ArchObj ao \<Rightarrow> AArch (case ao of ASIDPool f \<Rightarrow> AASIDPool | PageTable pt \<Rightarrow> APageTable | PageDirectory pd \<Rightarrow> APageDirectory | DataPage dev sz \<Rightarrow> if dev then ADeviceData sz else AUserData sz)) = AArch APageTable
 2. \<And>s xs ap rv fun funa funb pda x21 x22 x23. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x21) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x21) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (?pt908 s xs ap rv fun funa funb pda x21 x22 x23) 10\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 3. \<And>s xs ap rv fun funa funb pda x31 x32 x33 x34. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x31) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x31) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 4. \<And>s xs ap rv fun funa funb pda x41 x42 x43. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x41) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x41) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 5. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 6. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (5 subgoals):
 1. \<And>s xs ap rv fun funa funb pda x21 x22 x23. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x21) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x21) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 2. \<And>s xs ap rv fun funa funb pda x31 x32 x33 x34. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x31) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x31) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 3. \<And>s xs ap rv fun funa funb pda x41 x42 x43. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x41) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x41) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 4. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 5. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (5 subgoals):
 1. \<And>s xs ap rv fun x21 x22 x23 pt pd pta. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x21) s; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10; kheap s (ptrFromPAddr x21 + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) = Some (ArchObj (PageTable pta))\<rbrakk> \<Longrightarrow> ((case pta (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x21 + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x21 + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x21 + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pta (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x21 + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage)
 2. \<And>s xs ap rv fun funa funb pda x31 x32 x33 x34. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x31) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x31) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 3. \<And>s xs ap rv fun funa funb pda x41 x42 x43. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x41) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x41) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 4. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 5. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (5 subgoals):
 1. \<And>s xs ap rv fun x21 x22 x23 pt pd pta. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pta)); pte_ref_pages (pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x21) s; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10; pt = pta\<rbrakk> \<Longrightarrow> ((case pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && 0xFF << 2 >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x21 + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x21 + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && 0xFF << 2 >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage)
 2. \<And>s xs ap rv fun funa funb pda x31 x32 x33 x34. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x31) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x31) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 3. \<And>s xs ap rv fun funa funb pda x41 x42 x43. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x41) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x41) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 4. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 5. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (8 subgoals):
 1. \<And>s xs ap rv fun x21 x22 x23 pt pd pta. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pta)); pte_ref_pages (pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10; pt = pta\<rbrakk> \<Longrightarrow> typ_at (AArch APageTable) (ptrFromPAddr x21) s \<or> typ_at (AArch APageDirectory) (ptrFromPAddr x21) s \<or> typ_at (AArch AASIDPool) (ptrFromPAddr x21) s
 2. \<And>s xs ap rv fun x21 x22 x23 pt pd pta. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pta)); pte_ref_pages (pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10; pt = pta\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 3. \<And>s xs ap rv fun x21 x22 x23 pt pd pta. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pta)); pte_ref_pages (pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10; pt = pta\<rbrakk> \<Longrightarrow> valid_asid_table (asid_table s) s
 4. \<And>s xs ap rv fun x21 x22 x23 pt pd pta. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pta)); pte_ref_pages (pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10; pt = pta; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x21) s\<rbrakk> \<Longrightarrow> ((case pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && 0xFF << 2 >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x21 + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x21 + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && 0xFF << 2 >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage)
 5. \<And>s xs ap rv fun funa funb pda x31 x32 x33 x34. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x31) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x31) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 6. \<And>s xs ap rv fun funa funb pda x41 x42 x43. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x41) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x41) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 7. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 8. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (5 subgoals):
 1. \<And>s xs ap rv fun x21 x22 x23 pt pd pta. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pta)); pte_ref_pages (pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10; pt = pta; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x21) s\<rbrakk> \<Longrightarrow> ((case pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && 0xFF << 2 >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x21 + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x21 + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && 0xFF << 2 >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage)
 2. \<And>s xs ap rv fun funa funb pda x31 x32 x33 x34. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x31) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x31) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 3. \<And>s xs ap rv fun funa funb pda x41 x42 x43. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x41) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x41) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 4. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 5. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (7 subgoals):
 1. \<And>s xs ap rv fun x21 x22 x23 pt pd pta. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pta)); pte_ref_pages (pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10; pt = pta; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x21) s\<rbrakk> \<Longrightarrow> ako_at (?ao1259 s xs ap rv fun x21 x22 x23 pt pd pta) (ptrFromPAddr x21) s
 2. \<And>s xs ap rv fun x21 x22 x23 pt pd pta. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pta)); pte_ref_pages (pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10; pt = pta; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x21) s\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 3. \<And>s xs ap rv fun x21 x22 x23 pt pd pta. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pta)); pte_ref_pages (pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10; pt = pta; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x21) s; valid_vspace_obj (?ao1259 s xs ap rv fun x21 x22 x23 pt pd pta) s\<rbrakk> \<Longrightarrow> ((case pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && 0xFF << 2 >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x21 + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x21 + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && 0xFF << 2 >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage)
 4. \<And>s xs ap rv fun funa funb pda x31 x32 x33 x34. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x31) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x31) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 5. \<And>s xs ap rv fun funa funb pda x41 x42 x43. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x41) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x41) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 6. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 7. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (5 subgoals):
 1. \<And>s xs ap rv fun x21 x22 x23 pt pd pta. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pta)); pte_ref_pages (pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10; pt = pta; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x21) s; valid_vspace_obj (PageTable pta) s\<rbrakk> \<Longrightarrow> ((case pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && 0xFF << 2 >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x21 + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x21 + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && 0xFF << 2 >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage)
 2. \<And>s xs ap rv fun funa funb pda x31 x32 x33 x34. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x31) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x31) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 3. \<And>s xs ap rv fun funa funb pda x41 x42 x43. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x41) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x41) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 4. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 5. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (5 subgoals):
 1. \<And>s xs ap rv fun x21 x22 x23 pt pd pta. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pta)); pte_ref_pages (pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10; pt = pta; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x21) s; \<forall>x. valid_pte (pta x) s\<rbrakk> \<Longrightarrow> ((case pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && 0xFF << 2 >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x21 + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x21 + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && 0xFF << 2 >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage)
 2. \<And>s xs ap rv fun funa funb pda x31 x32 x33 x34. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x31) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x31) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 3. \<And>s xs ap rv fun funa funb pda x41 x42 x43. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x41) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x41) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 4. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 5. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (6 subgoals):
 1. \<And>s xs ap rv fun x21 x22 x23 pt pd pta. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pta)); pte_ref_pages (pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10; pt = pta; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x21) s; \<forall>x. valid_pte (pta x) s; case pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && 0xFF << 2 >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage; ptrFromPAddr x21 + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0\<rbrakk> \<Longrightarrow> \<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x21 + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2)
 2. \<And>s xs ap rv fun x21 x22 x23 pt pd pta. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pta)); pte_ref_pages (pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10; pt = pta; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x21) s; \<forall>x. valid_pte (pta x) s\<rbrakk> \<Longrightarrow> case pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && 0xFF << 2 >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage
 3. \<And>s xs ap rv fun funa funb pda x31 x32 x33 x34. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x31) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x31) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 4. \<And>s xs ap rv fun funa funb pda x41 x42 x43. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x41) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x41) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 5. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 6. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (5 subgoals):
 1. \<And>s xs ap rv fun x21 x22 x23 pt pd pta. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pta)); pte_ref_pages (pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10; pt = pta; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x21) s; \<forall>x. valid_pte (pta x) s\<rbrakk> \<Longrightarrow> case pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && 0xFF << 2 >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage
 2. \<And>s xs ap rv fun funa funb pda x31 x32 x33 x34. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x31) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x31) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 3. \<And>s xs ap rv fun funa funb pda x41 x42 x43. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x41) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x41) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 4. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 5. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (5 subgoals):
 1. \<And>s xs ap rv fun x21 x22 x23 pt pd pta. \<lbrakk>kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pta)); pte_ref_pages (pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; is_aligned (ptrFromPAddr x21) 10; pt = pta; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> ptrFromPAddr x21) s; valid_pte (pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) s\<rbrakk> \<Longrightarrow> case pta (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && 0xFF << 2 >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage
 2. \<And>s xs ap rv fun funa funb pda x31 x32 x33 x34. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x31) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x31) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 3. \<And>s xs ap rv fun funa funb pda x41 x42 x43. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x41) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x41) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 4. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 5. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (4 subgoals):
 1. \<And>s xs ap rv fun funa funb pda x31 x32 x33 x34. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x31) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x31) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 2. \<And>s xs ap rv fun funa funb pda x41 x42 x43. \<lbrakk>ako_at (PageTable funb) (ptrFromPAddr x41) s; pte_ref_pages (funb (UCAST(32 \<rightarrow> 8) ((vaddr >> 12) && mask 8))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef ((vaddr >> 12) && mask 8) (Some APageTable), VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMLargePage pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMLargePage; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ptrFromPAddr x41) s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x. (\<exists>xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x xa xb) \<longrightarrow> (\<forall>pt. ako_at (PageTable pt) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && ~~ mask pt_bits) s \<longrightarrow> ((case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage) \<longrightarrow> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask 6 = 0 \<longrightarrow> (\<exists>pt. ([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> pt) s \<and> is_aligned pt pt_bits \<and> ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) = pt + ((vaddr >> 12) && mask 8 << 2))) \<and> (case pt (UCAST(32 \<rightarrow> 8) (ptrFromPAddr x + ((vaddr >> 12) && 0xFF << 2) && mask pt_bits >> 2)) of InvalidPTE \<Rightarrow> False | LargePagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMLargePage | SmallPagePTE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMLargePage = ARMSmallPage))) \<and> (\<forall>x xa xb xc. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x xa xb xc) \<and> (\<forall>x xa xb. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x xa xb)
 3. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 4. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (2 subgoals):
 1. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 2. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (2 subgoals):
 1. \<And>s xs. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; \<exists>ap fun pd funa. ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s \<and> asid_table s (asid_high_bits_of asid) = Some ap \<and> ako_at (ASIDPool fun) ap s \<and> ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pd) s \<and> fun (UCAST(32 \<rightarrow> 10) (asid && mask local.asid_low_bits)) = Some pd \<and> ako_at (PageDirectory funa) pd s \<and> pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s)
 2. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (3 subgoals):
 1. \<And>s xs. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; \<exists>ap fun pd funa. ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s \<and> asid_table s (asid_high_bits_of asid) = Some ap \<and> ako_at (ASIDPool fun) ap s \<and> ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pd) s \<and> fun (UCAST(32 \<rightarrow> 10) (asid && mask local.asid_low_bits)) = Some pd \<and> ako_at (PageDirectory funa) pd s \<and> pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr\<rbrakk> \<Longrightarrow> \<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s
 2. \<And>s xs. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; \<exists>ap fun pd funa. ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s \<and> asid_table s (asid_high_bits_of asid) = Some ap \<and> ako_at (ASIDPool fun) ap s \<and> ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pd) s \<and> fun (UCAST(32 \<rightarrow> 10) (asid && mask local.asid_low_bits)) = Some pd \<and> ako_at (PageDirectory funa) pd s \<and> pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr\<rbrakk> \<Longrightarrow> \<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))
 3. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (2 subgoals):
 1. \<And>s xs. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; \<exists>ap fun pd funa. ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s \<and> asid_table s (asid_high_bits_of asid) = Some ap \<and> ako_at (ASIDPool fun) ap s \<and> ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pd) s \<and> fun (UCAST(32 \<rightarrow> 10) (asid && mask local.asid_low_bits)) = Some pd \<and> ako_at (PageDirectory funa) pd s \<and> pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr\<rbrakk> \<Longrightarrow> \<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False))
 2. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (2 subgoals):
 1. \<And>s xs ap rv fun pd funa pda. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pd) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some pd; ako_at (PageDirectory funa) pd s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s\<rbrakk> \<Longrightarrow> ((case pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False)
 2. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (2 subgoals):
 1. \<And>s xs ap rv fun pd funa pda. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pd) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some pd; ako_at (PageDirectory funa) pd s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s; pd = rv\<rbrakk> \<Longrightarrow> ((case pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False)
 2. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (2 subgoals):
 1. \<And>s xs ap rv fun pd funa pda. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pd) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some pd; ako_at (PageDirectory funa) pd s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s; pd = rv; is_aligned rv 14\<rbrakk> \<Longrightarrow> ((case pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False)
 2. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (2 subgoals):
 1. \<And>s xs ap rv fun pd funa pda. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14\<rbrakk> \<Longrightarrow> ((case pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False)
 2. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (4 subgoals):
 1. \<And>s xs ap rv fun pd funa pda. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14\<rbrakk> \<Longrightarrow> ako_at (?ao1370 s xs ap rv fun pd funa pda) rv s
 2. \<And>s xs ap rv fun pd funa pda. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 3. \<And>s xs ap rv fun pd funa pda. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14; valid_vspace_obj (?ao1370 s xs ap rv fun pd funa pda) s\<rbrakk> \<Longrightarrow> ((case pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False)
 4. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (4 subgoals):
 1. \<And>s xs ap rv fun funa. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; kheap s rv = Some (ArchObj (PageDirectory funa)); pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; is_aligned rv 14\<rbrakk> \<Longrightarrow> ?ao1370 s xs ap rv fun rv funa funa = PageDirectory funa
 2. \<And>s xs ap rv fun pd funa pda. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 3. \<And>s xs ap rv fun pd funa pda. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14; valid_vspace_obj (?ao1370 s xs ap rv fun pd funa pda) s\<rbrakk> \<Longrightarrow> ((case pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False)
 4. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (3 subgoals):
 1. \<And>s xs ap rv fun pd funa pda. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 2. \<And>s xs ap rv fun pd funa pda. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14; valid_vspace_obj (PageDirectory pda) s\<rbrakk> \<Longrightarrow> ((case pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False)
 3. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (2 subgoals):
 1. \<And>s xs ap rv fun pd funa pda. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14; valid_vspace_obj (PageDirectory pda) s\<rbrakk> \<Longrightarrow> ((case pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False)
 2. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (2 subgoals):
 1. \<And>s xs ap rv fun pd funa pda. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s\<rbrakk> \<Longrightarrow> ((case pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> is_aligned rv pd_bits) \<and> (case pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSection = ARMSuperSection | _ \<Rightarrow> False)
 2. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (4 subgoals):
 1. \<And>s xs ap rv fun funa pda x21 x22 x23. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x21; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection (ptrFromPAddr x21) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; pptr = ptrFromPAddr x21\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31. (\<exists>x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34) \<longrightarrow> (x31 = x21 \<longrightarrow> is_aligned rv pd_bits) \<and> x31 = x21) \<and> (\<forall>x41 x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x41 x42 x43)
 2. \<And>s xs ap rv fun funa pda x31 x32 x33 x34. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x31; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection (ptrFromPAddr x31) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34; pptr = ptrFromPAddr x31\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31a. (\<exists>x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31a x32 x33 x34) \<longrightarrow> (x31a = x31 \<longrightarrow> is_aligned rv pd_bits) \<and> x31a = x31) \<and> (\<forall>x41 x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x41 x42 x43)
 3. \<And>s xs ap rv fun funa pda x41 x42 x43. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x41; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection (ptrFromPAddr x41) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43; pptr = ptrFromPAddr x41\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31. (\<exists>x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34) \<longrightarrow> (x31 = x41 \<longrightarrow> is_aligned rv pd_bits) \<and> x31 = x41) \<and> (\<forall>x41 x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x41 x42 x43)
 4. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (4 subgoals):
 1. \<And>s xs ap rv fun x21 x22 x23 pd pt. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x21; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; a_type (ArchObj (PageTable pt)) = AArch (AUserData ARMSection) \<or> a_type (ArchObj (PageTable pt)) = AArch (ADeviceData ARMSection); valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; pptr = ptrFromPAddr x21; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt))\<rbrakk> \<Longrightarrow> False
 2. \<And>s xs ap rv fun funa pda x31 x32 x33 x34. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x31; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection (ptrFromPAddr x31) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34; pptr = ptrFromPAddr x31\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31a. (\<exists>x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31a x32 x33 x34) \<longrightarrow> (x31a = x31 \<longrightarrow> is_aligned rv pd_bits) \<and> x31a = x31) \<and> (\<forall>x41 x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x41 x42 x43)
 3. \<And>s xs ap rv fun funa pda x41 x42 x43. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x41; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection (ptrFromPAddr x41) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43; pptr = ptrFromPAddr x41\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31. (\<exists>x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34) \<longrightarrow> (x31 = x41 \<longrightarrow> is_aligned rv pd_bits) \<and> x31 = x41) \<and> (\<forall>x41 x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x41 x42 x43)
 4. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (7 subgoals):
 1. \<And>s xs ap rv fun x21 x22 x23 pd pt. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x21; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; a_type (ArchObj (PageTable pt)) = AArch (AUserData ARMSection) \<or> a_type (ArchObj (PageTable pt)) = AArch (ADeviceData ARMSection); valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; pptr = ptrFromPAddr x21; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt))\<rbrakk> \<Longrightarrow> typ_at (AArch APageTable) rv s \<or> typ_at (AArch APageDirectory) rv s \<or> typ_at (AArch AASIDPool) rv s
 2. \<And>s xs ap rv fun x21 x22 x23 pd pt. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x21; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; a_type (ArchObj (PageTable pt)) = AArch (AUserData ARMSection) \<or> a_type (ArchObj (PageTable pt)) = AArch (ADeviceData ARMSection); valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; pptr = ptrFromPAddr x21; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt))\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 3. \<And>s xs ap rv fun x21 x22 x23 pd pt. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x21; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; a_type (ArchObj (PageTable pt)) = AArch (AUserData ARMSection) \<or> a_type (ArchObj (PageTable pt)) = AArch (ADeviceData ARMSection); valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; pptr = ptrFromPAddr x21; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt))\<rbrakk> \<Longrightarrow> valid_asid_table (asid_table s) s
 4. \<And>s xs ap rv fun x21 x22 x23 pd pt. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x21; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; a_type (ArchObj (PageTable pt)) = AArch (AUserData ARMSection) \<or> a_type (ArchObj (PageTable pt)) = AArch (ADeviceData ARMSection); valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; pptr = ptrFromPAddr x21; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s\<rbrakk> \<Longrightarrow> False
 5. \<And>s xs ap rv fun funa pda x31 x32 x33 x34. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x31; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection (ptrFromPAddr x31) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34; pptr = ptrFromPAddr x31\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31a. (\<exists>x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31a x32 x33 x34) \<longrightarrow> (x31a = x31 \<longrightarrow> is_aligned rv pd_bits) \<and> x31a = x31) \<and> (\<forall>x41 x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x41 x42 x43)
 6. \<And>s xs ap rv fun funa pda x41 x42 x43. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x41; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection (ptrFromPAddr x41) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43; pptr = ptrFromPAddr x41\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31. (\<exists>x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34) \<longrightarrow> (x31 = x41 \<longrightarrow> is_aligned rv pd_bits) \<and> x31 = x41) \<and> (\<forall>x41 x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x41 x42 x43)
 7. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (4 subgoals):
 1. \<And>s xs ap rv fun x21 x22 x23 pd pt. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x21; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; a_type (ArchObj (PageTable pt)) = AArch (AUserData ARMSection) \<or> a_type (ArchObj (PageTable pt)) = AArch (ADeviceData ARMSection); valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; pptr = ptrFromPAddr x21; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s\<rbrakk> \<Longrightarrow> False
 2. \<And>s xs ap rv fun funa pda x31 x32 x33 x34. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x31; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection (ptrFromPAddr x31) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34; pptr = ptrFromPAddr x31\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31a. (\<exists>x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31a x32 x33 x34) \<longrightarrow> (x31a = x31 \<longrightarrow> is_aligned rv pd_bits) \<and> x31a = x31) \<and> (\<forall>x41 x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x41 x42 x43)
 3. \<And>s xs ap rv fun funa pda x41 x42 x43. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x41; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection (ptrFromPAddr x41) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43; pptr = ptrFromPAddr x41\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31. (\<exists>x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34) \<longrightarrow> (x31 = x41 \<longrightarrow> is_aligned rv pd_bits) \<and> x31 = x41) \<and> (\<forall>x41 x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x41 x42 x43)
 4. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (6 subgoals):
 1. \<And>s xs ap rv fun x21 x22 x23 pd pt. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x21; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; a_type (ArchObj (PageTable pt)) = AArch (AUserData ARMSection) \<or> a_type (ArchObj (PageTable pt)) = AArch (ADeviceData ARMSection); valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; pptr = ptrFromPAddr x21; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s\<rbrakk> \<Longrightarrow> ako_at (?ao1450 s xs ap rv fun x21 x22 x23 pd pt) rv s
 2. \<And>s xs ap rv fun x21 x22 x23 pd pt. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x21; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; a_type (ArchObj (PageTable pt)) = AArch (AUserData ARMSection) \<or> a_type (ArchObj (PageTable pt)) = AArch (ADeviceData ARMSection); valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; pptr = ptrFromPAddr x21; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 3. \<And>s xs ap rv fun x21 x22 x23 pd pt. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x21; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; a_type (ArchObj (PageTable pt)) = AArch (AUserData ARMSection) \<or> a_type (ArchObj (PageTable pt)) = AArch (ADeviceData ARMSection); valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; pptr = ptrFromPAddr x21; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; valid_vspace_obj (?ao1450 s xs ap rv fun x21 x22 x23 pd pt) s\<rbrakk> \<Longrightarrow> False
 4. \<And>s xs ap rv fun funa pda x31 x32 x33 x34. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x31; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection (ptrFromPAddr x31) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34; pptr = ptrFromPAddr x31\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31a. (\<exists>x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31a x32 x33 x34) \<longrightarrow> (x31a = x31 \<longrightarrow> is_aligned rv pd_bits) \<and> x31a = x31) \<and> (\<forall>x41 x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x41 x42 x43)
 5. \<And>s xs ap rv fun funa pda x41 x42 x43. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x41; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection (ptrFromPAddr x41) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43; pptr = ptrFromPAddr x41\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31. (\<exists>x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34) \<longrightarrow> (x31 = x41 \<longrightarrow> is_aligned rv pd_bits) \<and> x31 = x41) \<and> (\<forall>x41 x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x41 x42 x43)
 6. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (4 subgoals):
 1. \<And>s xs ap rv fun x21 x22 x23 pd pt. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; kheap s rv = Some (ArchObj (PageDirectory pd)); is_aligned rv 14; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x21; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; a_type (ArchObj (PageTable pt)) = AArch (AUserData ARMSection) \<or> a_type (ArchObj (PageTable pt)) = AArch (ADeviceData ARMSection); valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; pd (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; pptr = ptrFromPAddr x21; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable pt)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; valid_vspace_obj (PageDirectory pd) s\<rbrakk> \<Longrightarrow> False
 2. \<And>s xs ap rv fun funa pda x31 x32 x33 x34. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x31; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection (ptrFromPAddr x31) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34; pptr = ptrFromPAddr x31\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31a. (\<exists>x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31a x32 x33 x34) \<longrightarrow> (x31a = x31 \<longrightarrow> is_aligned rv pd_bits) \<and> x31a = x31) \<and> (\<forall>x41 x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x41 x42 x43)
 3. \<And>s xs ap rv fun funa pda x41 x42 x43. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x41; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection (ptrFromPAddr x41) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43; pptr = ptrFromPAddr x41\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31. (\<exists>x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34) \<longrightarrow> (x31 = x41 \<longrightarrow> is_aligned rv pd_bits) \<and> x31 = x41) \<and> (\<forall>x41 x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x41 x42 x43)
 4. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (3 subgoals):
 1. \<And>s xs ap rv fun funa pda x31 x32 x33 x34. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x31; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection (ptrFromPAddr x31) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34; pptr = ptrFromPAddr x31\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31a. (\<exists>x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31a x32 x33 x34) \<longrightarrow> (x31a = x31 \<longrightarrow> is_aligned rv pd_bits) \<and> x31a = x31) \<and> (\<forall>x41 x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x41 x42 x43)
 2. \<And>s xs ap rv fun funa pda x41 x42 x43. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x41; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection (ptrFromPAddr x41) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43; pptr = ptrFromPAddr x41\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31. (\<exists>x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34) \<longrightarrow> (x31 = x41 \<longrightarrow> is_aligned rv pd_bits) \<and> x31 = x41) \<and> (\<forall>x41 x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x41 x42 x43)
 3. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (2 subgoals):
 1. \<And>s xs ap rv fun funa pda x41 x42 x43. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x41; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSection (ptrFromPAddr x41) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43; pptr = ptrFromPAddr x41\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31. (\<exists>x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34) \<longrightarrow> (x31 = x41 \<longrightarrow> is_aligned rv pd_bits) \<and> x31 = x41) \<and> (\<forall>x41 x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SuperSectionPDE x41 x42 x43)
 2. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (1 subgoal):
 1. \<And>s xs. \<lbrakk>([VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pptr) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (1 subgoal):
 1. \<And>s xs. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; \<exists>ap fun pd funa. ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s \<and> asid_table s (asid_high_bits_of asid) = Some ap \<and> ako_at (ASIDPool fun) ap s \<and> ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pd) s \<and> fun (UCAST(32 \<rightarrow> 10) (asid && mask local.asid_low_bits)) = Some pd \<and> ako_at (PageDirectory funa) pd s \<and> pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr\<rbrakk> \<Longrightarrow> (\<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False))) \<and> (\<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s) proof (prove)
goal (2 subgoals):
 1. \<And>s xs. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; \<exists>ap fun pd funa. ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s \<and> asid_table s (asid_high_bits_of asid) = Some ap \<and> ako_at (ASIDPool fun) ap s \<and> ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pd) s \<and> fun (UCAST(32 \<rightarrow> 10) (asid && mask local.asid_low_bits)) = Some pd \<and> ako_at (PageDirectory funa) pd s \<and> pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr\<rbrakk> \<Longrightarrow> \<exists>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s
 2. \<And>s xs. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; \<exists>ap fun pd funa. ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s \<and> asid_table s (asid_high_bits_of asid) = Some ap \<and> ako_at (ASIDPool fun) ap s \<and> ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pd) s \<and> fun (UCAST(32 \<rightarrow> 10) (asid && mask local.asid_low_bits)) = Some pd \<and> ako_at (PageDirectory funa) pd s \<and> pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr\<rbrakk> \<Longrightarrow> \<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False)) proof (prove)
goal (1 subgoal):
 1. \<And>s xs. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; \<exists>ap fun pd funa. ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s \<and> asid_table s (asid_high_bits_of asid) = Some ap \<and> ako_at (ASIDPool fun) ap s \<and> ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pd) s \<and> fun (UCAST(32 \<rightarrow> 10) (asid && mask local.asid_low_bits)) = Some pd \<and> ako_at (PageDirectory funa) pd s \<and> pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr\<rbrakk> \<Longrightarrow> \<forall>rv. ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s \<longrightarrow> typ_at (AArch APageDirectory) rv s \<longrightarrow> (\<forall>pd. ako_at (PageDirectory pd) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pd (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False)) proof (prove)
goal (1 subgoal):
 1. \<And>s xs ap rv fun pd funa pda. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pd) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some pd; ako_at (PageDirectory funa) pd s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s\<rbrakk> \<Longrightarrow> ((case pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) proof (prove)
goal (1 subgoal):
 1. \<And>s xs ap rv fun pd funa pda. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pd) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some pd; ako_at (PageDirectory funa) pd s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s; pd = rv\<rbrakk> \<Longrightarrow> ((case pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) proof (prove)
goal (1 subgoal):
 1. \<And>s xs ap rv fun pd funa pda. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> pd) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some pd; ako_at (PageDirectory funa) pd s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) (rv + (vaddr >> 20 << 2) && ~~ mask pd_bits) s; pd = rv; is_aligned rv 14\<rbrakk> \<Longrightarrow> ((case pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pda (UCAST(32 \<rightarrow> 12) (rv + (vaddr >> 20 << 2) && mask pd_bits >> 2)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) proof (prove)
goal (1 subgoal):
 1. \<And>s xs ap rv fun pd funa pda. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14\<rbrakk> \<Longrightarrow> ((case pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) proof (prove)
goal (3 subgoals):
 1. \<And>s xs ap rv fun pd funa pda. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14\<rbrakk> \<Longrightarrow> ako_at (?ao1564 s xs ap rv fun pd funa pda) rv s
 2. \<And>s xs ap rv fun pd funa pda. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 3. \<And>s xs ap rv fun pd funa pda. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14; valid_vspace_obj (?ao1564 s xs ap rv fun pd funa pda) s\<rbrakk> \<Longrightarrow> ((case pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) proof (prove)
goal (3 subgoals):
 1. \<And>s xs ap rv fun funa. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; kheap s ap = Some (ArchObj (ASIDPool fun)); ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; kheap s rv = Some (ArchObj (PageDirectory funa)); pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; is_aligned rv 14\<rbrakk> \<Longrightarrow> ?ao1564 s xs ap rv fun rv funa funa = PageDirectory funa
 2. \<And>s xs ap rv fun pd funa pda. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 3. \<And>s xs ap rv fun pd funa pda. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14; valid_vspace_obj (?ao1564 s xs ap rv fun pd funa pda) s\<rbrakk> \<Longrightarrow> ((case pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) proof (prove)
goal (2 subgoals):
 1. \<And>s xs ap rv fun pd funa pda. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 2. \<And>s xs ap rv fun pd funa pda. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14; valid_vspace_obj (PageDirectory pda) s\<rbrakk> \<Longrightarrow> ((case pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) proof (prove)
goal (1 subgoal):
 1. \<And>s xs ap rv fun pd funa pda. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14; valid_vspace_obj (PageDirectory pda) s\<rbrakk> \<Longrightarrow> ((case pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) proof (prove)
goal (1 subgoal):
 1. \<And>s xs ap rv fun pd funa pda. \<lbrakk>ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = pptr; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection pptr s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; pde_ref_pages (funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) = Some pptr; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; pd = rv; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s\<rbrakk> \<Longrightarrow> ((case pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> (case pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) of SectionPDE x xa xb xc \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSection | SuperSectionPDE x xa xb \<Rightarrow> x = addrFromPPtr pptr \<and> ARMSuperSection = ARMSuperSection | _ \<Rightarrow> False) proof (prove)
goal (3 subgoals):
 1. \<And>s xs ap rv fun funa pda x21 x22 x23. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x21; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection (ptrFromPAddr x21) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = PageTablePDE x21 x22 x23; pptr = ptrFromPAddr x21\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31 x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x31 x32 x33 x34) \<and> (\<forall>x41. (\<exists>x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43) \<longrightarrow> (x41 = x21 \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> x41 = x21)
 2. \<And>s xs ap rv fun funa pda x31 x32 x33 x34. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x31; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection (ptrFromPAddr x31) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34; pptr = ptrFromPAddr x31\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31 x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x31 x32 x33 x34) \<and> (\<forall>x41. (\<exists>x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43) \<longrightarrow> (x41 = x31 \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> x41 = x31)
 3. \<And>s xs ap rv fun funa pda x41 x42 x43. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x41; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection (ptrFromPAddr x41) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43; pptr = ptrFromPAddr x41\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31 x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x31 x32 x33 x34) \<and> (\<forall>x41a. (\<exists>x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41a x42 x43) \<longrightarrow> (x41a = x41 \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> x41a = x41) proof (prove)
goal (2 subgoals):
 1. \<And>s xs ap rv fun funa pda x31 x32 x33 x34. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x31; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection (ptrFromPAddr x31) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34; pptr = ptrFromPAddr x31\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31 x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x31 x32 x33 x34) \<and> (\<forall>x41. (\<exists>x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43) \<longrightarrow> (x41 = x31 \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> x41 = x31)
 2. \<And>s xs ap rv fun funa pda x41 x42 x43. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x41; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection (ptrFromPAddr x41) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43; pptr = ptrFromPAddr x41\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31 x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x31 x32 x33 x34) \<and> (\<forall>x41a. (\<exists>x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41a x42 x43) \<longrightarrow> (x41a = x41 \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> x41a = x41) proof (prove)
goal (5 subgoals):
 1. \<And>s xs ap rv fun funa pda x31 x32 x33 x34. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x31; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection (ptrFromPAddr x31) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34; pptr = ptrFromPAddr x31\<rbrakk> \<Longrightarrow> typ_at (AArch APageTable) rv s \<or> typ_at (AArch APageDirectory) rv s \<or> typ_at (AArch AASIDPool) rv s
 2. \<And>s xs ap rv fun funa pda x31 x32 x33 x34. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x31; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection (ptrFromPAddr x31) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34; pptr = ptrFromPAddr x31\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 3. \<And>s xs ap rv fun funa pda x31 x32 x33 x34. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x31; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection (ptrFromPAddr x31) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34; pptr = ptrFromPAddr x31\<rbrakk> \<Longrightarrow> valid_asid_table (asid_table s) s
 4. \<And>s xs ap rv fun funa pda x31 x32 x33 x34. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x31; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection (ptrFromPAddr x31) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34; pptr = ptrFromPAddr x31; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31 x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x31 x32 x33 x34) \<and> (\<forall>x41. (\<exists>x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43) \<longrightarrow> (x41 = x31 \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> x41 = x31)
 5. \<And>s xs ap rv fun funa pda x41 x42 x43. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x41; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection (ptrFromPAddr x41) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43; pptr = ptrFromPAddr x41\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31 x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x31 x32 x33 x34) \<and> (\<forall>x41a. (\<exists>x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41a x42 x43) \<longrightarrow> (x41a = x41 \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> x41a = x41) proof (prove)
goal (2 subgoals):
 1. \<And>s xs ap rv fun funa pda x31 x32 x33 x34. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x31; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection (ptrFromPAddr x31) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34; pptr = ptrFromPAddr x31; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31 x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x31 x32 x33 x34) \<and> (\<forall>x41. (\<exists>x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43) \<longrightarrow> (x41 = x31 \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> x41 = x31)
 2. \<And>s xs ap rv fun funa pda x41 x42 x43. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x41; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection (ptrFromPAddr x41) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43; pptr = ptrFromPAddr x41\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31 x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x31 x32 x33 x34) \<and> (\<forall>x41a. (\<exists>x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41a x42 x43) \<longrightarrow> (x41a = x41 \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> x41a = x41) proof (prove)
goal (4 subgoals):
 1. \<And>s xs ap rv fun funa pda x31 x32 x33 x34. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x31; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection (ptrFromPAddr x31) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34; pptr = ptrFromPAddr x31; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s\<rbrakk> \<Longrightarrow> ako_at (?ao1675 s xs ap rv fun funa pda x31 x32 x33 x34) rv s
 2. \<And>s xs ap rv fun funa pda x31 x32 x33 x34. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x31; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection (ptrFromPAddr x31) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34; pptr = ptrFromPAddr x31; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 3. \<And>s xs ap rv fun funa pda x31 x32 x33 x34. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x31; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection (ptrFromPAddr x31) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34; pptr = ptrFromPAddr x31; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; valid_vspace_obj (?ao1675 s xs ap rv fun funa pda x31 x32 x33 x34) s\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31 x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x31 x32 x33 x34) \<and> (\<forall>x41. (\<exists>x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43) \<longrightarrow> (x41 = x31 \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> x41 = x31)
 4. \<And>s xs ap rv fun funa pda x41 x42 x43. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x41; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection (ptrFromPAddr x41) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43; pptr = ptrFromPAddr x41\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31 x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x31 x32 x33 x34) \<and> (\<forall>x41a. (\<exists>x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41a x42 x43) \<longrightarrow> (x41a = x41 \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> x41a = x41) proof (prove)
goal (2 subgoals):
 1. \<And>s xs ap rv fun funa pda x31 x32 x33 x34. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x31; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection (ptrFromPAddr x31) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34; pptr = ptrFromPAddr x31; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; valid_vspace_obj (PageDirectory pda) s\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31 x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x31 x32 x33 x34) \<and> (\<forall>x41. (\<exists>x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43) \<longrightarrow> (x41 = x31 \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> x41 = x31)
 2. \<And>s xs ap rv fun funa pda x41 x42 x43. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x41; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection (ptrFromPAddr x41) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43; pptr = ptrFromPAddr x41\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31 x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x31 x32 x33 x34) \<and> (\<forall>x41a. (\<exists>x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41a x42 x43) \<longrightarrow> (x41a = x41 \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> x41a = x41) proof (prove)
goal (2 subgoals):
 1. \<And>s xs ap rv fun funa pda x31 x32 x33 x34. \<lbrakk>typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x31; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection (ptrFromPAddr x31) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34; pptr = ptrFromPAddr x31; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; \<forall>x\<in>- kernel_mapping_slots. valid_pde (pda x) s\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31 x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x31 x32 x33 x34) \<and> (\<forall>x41. (\<exists>x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43) \<longrightarrow> (x41 = x31 \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> x41 = x31)
 2. \<And>s xs ap rv fun funa pda x41 x42 x43. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x41; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection (ptrFromPAddr x41) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43; pptr = ptrFromPAddr x41\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31 x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x31 x32 x33 x34) \<and> (\<forall>x41a. (\<exists>x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41a x42 x43) \<longrightarrow> (x41a = x41 \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> x41a = x41) proof (prove)
goal (2 subgoals):
 1. \<And>s xs ap rv fun funa pda x31 x32 x33 x34. \<lbrakk>typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x31; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection (ptrFromPAddr x31) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SectionPDE x31 x32 x33 x34; pptr = ptrFromPAddr x31; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31 x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x31 x32 x33 x34) \<and> (\<forall>x41. (\<exists>x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43) \<longrightarrow> (x41 = x31 \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> x41 = x31)
 2. \<And>s xs ap rv fun funa pda x41 x42 x43. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x41; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection (ptrFromPAddr x41) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43; pptr = ptrFromPAddr x41\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31 x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x31 x32 x33 x34) \<and> (\<forall>x41a. (\<exists>x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41a x42 x43) \<longrightarrow> (x41a = x41 \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> x41a = x41) proof (prove)
goal (1 subgoal):
 1. \<And>s xs ap rv fun funa pda x41 x42 x43. \<lbrakk>([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<rhd> rv) s; typ_at (AArch APageDirectory) rv s; ako_at (PageDirectory pda) rv s; is_aligned rv 14; valid_pde (pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20))) s; ref = [VSRef (vaddr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]; p = ptrFromPAddr x41; [0 , 4 .e. 0x3C] = 0 # xs; UCAST(32 \<rightarrow> 12) (vaddr >> 20) \<notin> kernel_mapping_slots; pspace_aligned s; valid_vspace_objs s; data_at ARMSuperSection (ptrFromPAddr x41) s; valid_objs s; valid_asid_table (asid_table s) s; sz = ARMSuperSection; ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> ap) s; asid_table s (asid_high_bits_of asid) = Some ap; ako_at (ASIDPool fun) ap s; ([VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] \<unrhd> rv) s; fun (UCAST(32 \<rightarrow> 10) asid) = Some rv; ako_at (PageDirectory funa) rv s; funa (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41 x42 x43; pptr = ptrFromPAddr x41\<rbrakk> \<Longrightarrow> pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> InvalidPDE \<and> (\<forall>x21 x22 x23. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> PageTablePDE x21 x22 x23) \<and> (\<forall>x31 x32 x33 x34. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) \<noteq> SectionPDE x31 x32 x33 x34) \<and> (\<forall>x41a. (\<exists>x42 x43. pda (UCAST(32 \<rightarrow> 12) (vaddr >> 20)) = SuperSectionPDE x41a x42 x43) \<longrightarrow> (x41a = x41 \<longrightarrow> rv + (vaddr >> 20 << 2) && mask 6 = 0 \<longrightarrow> is_aligned rv pd_bits) \<and> x41a = x41) proof (prove)
goal:
No subgoals!